- openldap-technical - openldap.org

Re: Client says Can't contact LDAP server, but it can!
by Gustavo Mendes de Carvalho 28 Jul '08

28 Jul '08

Hi There, I use self signed certificates with OpenLDAP, and everything works fine. Check bellow which commands I used to create this certificate ===> Self signed certificate generation (I am using RHAS 4 Up6) cd /usr/share/ssl rm -fr demoCA /usr/share/ssl/misc/CA -newca openssl req -newkey rsa:1024 -nodes -keyout newreq.pem -out newreq.pem /usr/share/ssl/misc/CA -sign ===> putting certificate files to correct place cp demoCA/cacert.pem /etc/openldap/cacerts/cacert.pem cp newcert.pem /etc/openldap/cacerts/servercrt.pem cp newreq.pem /etc/openldap/cacerts/serverkey.pem chmod 0400 /etc/openldap/cacerts/serverkey.pem chown -R ldap:ldap /etc/openldap/cacerts /etc/init.d/ldap restart ===> putting public certificate files in ldap client machines scp /etc/openldap/cacerts/cacert.pem root@<ip_client>:/etc/openldap/cacerts/. And set in ldap config files (in ldap client machine) the correct path When generating certificate file, be sure to specify in hostname field "hostname -f" output command. You can try using localhost too I hope it helps you --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com Date: Mon, 28 Jul 2008 09:20:23 +0200 From: Buchan Milne <bgmilne(a)staff.telkomsa.net> Subject: Re: Client says Can't contact LDAP server, but it can! To: openldap-technical(a)openldap.org Cc: John Oliver <joliver(a)john-oliver.net> Message-ID: <200807280920.33142.bgmilne(a)staff.telkomsa.net> Content-Type: text/plain; charset="iso-8859-1" On Friday 25 July 2008 17:16:12 John Oliver wrote: > On Fri, Jul 25, 2008 at 10:20:55AM +0200, Buchan Milne wrote: > > On Friday 25 July 2008 01:13:37 John Oliver wrote: > > > On Thu, Jul 24, 2008 at 04:04:10PM -0700, Quanah Gibson-Mount wrote: > > > > Any client will need to know about the CA that signed your > > > > self-signed cert. > > > > > > I created my certificate with: > > > > > > openssl req -new -x509 -nodes -out /etc/ssl/ldap.pem -keyout > > > /etc/openldap/ssl/ldap.pem -days 3650 > > > > > > In slapd.conf I have: > > > > > > TLSCertificateFile /etc/ssl/ldap.pem TLSCertificateKeyFile > > > /etc/openldap/ssl/ldap.pem TLSCACertificateFile /etc/ssl/ldap.pem > > > > > > What do I need to do differently? > > > > Configure the *client* ??? > > The clients work perfectly with the working server. Why would they > have to have a different configuration to talk to the backup LDAP server? They don't necessarily need a different configuration, but it being valid for one server doesn't guarantee it will be valid for another server, especially when it comes to ssl, certificate validation etc. > At the moment, I'm far more interested in getting the second LDAP > server working than I am in having perfect security. Then it's easy, turn off SSL. If you don't want to do that, turn of certificate validation. It's better than exposing keys. Or, ensure that the "CA certificate" that the clients use contains the certificates of the issuer of both of the server certificates, and that the value of the subject CN on both certificates matches the name you use to connect to the servers. Regards, Buchan

1 0

Re: N-way multimaster
by Miguel Jinez 28 Jul '08

28 Jul '08

Hi I have test from zero and I have test with historical information, I have found my old configuration and the logs are different, here master A: # 20080728211533.000002Z, accesslog dn: reqStart=20080728211533.000002Z,cn=accesslog objectClass: auditDelete reqStart: 20080728211533.000002Z reqEnd: 20080728211533.000003Z reqType: delete reqSession: 387 reqAuthzID: cn=admin,dc=ar reqDN: cn=user1000,dc=osde1,dc=ar reqResult: 0 Here master B # 20080728211533.000002Z, accesslog dn: reqStart=20080728211533.000002Z,cn=accesslog objectClass: auditDelete reqStart: 20080728211533.000002Z reqEnd: 20080728211533.000003Z reqType: delete reqSession: 387 reqAuthzID: cn=admin,dc=ar reqDN: cn=user1000,dc=osde1,dc=ar reqResult: 0 I am just using accesslog to look what is happening Greetings 2008/7/28 Gavin Henry <ghenry(a)openldap.org> > Hi, > > I meant originally. To test for me: > > 1. Emtpy both databases, including the accesslogs (accesslog not needed > here) > 2. Add original data to one node only, with the other switched off. > 3. Bring the other one up and let it pull data from the first node. > 4. Test they are the same and then try your delete situation. > > I think you've either added fresh data to each node so their *CSN values > are different so the deletes won't work. > > Please test and report back. > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ > > >

1 1

Re: N-way multimaster
by Miguel Jinez 28 Jul '08

28 Jul '08

Hi With my configuration at this time I have in one side: # 20080728202600.000001Z, accesslog dn: reqStart=20080728202600.000001Z,cn=accesslog objectClass: auditDelete reqStart: 20080728202600.000001Z reqEnd: 20080728202600.000002Z reqType: delete reqSession: 604 reqAuthzID: cn=admin,dc=ar reqDN: cn=user100,dc=osde1,dc=ar reqResult: 0 and nothing in the other side, let me try olds configurations to show you the mofify message 2008/7/26 Gavin Henry <ghenry(a)openldap.org> > <quote who="Miguel Jinez"> > > Yes, deletes are performed in one node > > How did you original load the data on each node? > > Can you show the failed delete logs? > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ >

1 0

Re: ACL Help Please
by david stackis 28 Jul '08

28 Jul '08

Hi Andrew - I unsubscribe to the openldap-software(a)openldap.org, but subscribe again today. I thought I had this ACL figured out. I'm trying to have users be able to add entries and to access their own address book. I think I have a pretty good start so far, but I'm having difficulty adding entries that only authenticated users have access to. I can add entries using "cn=root,dc=university,dc=edu" without any problems. Right now I have two users, but I'm confused as to how I get entries into their address book. Attached are both my init.ldif, and the slapd.conf I'm using. Any help is appreciated. My init.ldif # # Initialize the suffix entry defined in slapd.conf # dn: dc=University,dc=edu objectclass: top objectclass: dcObject objectclass: organization dc: university o: office # # Initialize the AddressBooks heirarchy # dn: ou=AddressBooks,dc=University,dc=edu objectclass: top objectclass: organizationalUnit ou: AddressBooks # # Define individual address books # dn: o=me,ou=AddressBooks,dc=University,dc=edu objectclass: top objectclass: organization o: me dn: o=you,ou=AddressBooks,dc=University,dc=edu objectclass: top objectclass: organization o: you # # Initialize the Users heirarchy # dn: ou=Users,dc=University,dc=edu objectclass: top objectclass: organizationalUnit ou: Users # # Define individual users # dn: cn=me,ou=Users,dc=University,dc=edu objectclass: top objectclass: person cn: me sn: Person userPassword: {crypt}XXXXXXX dn: cn=you,ou=Users,dc=University,dc=edu objectclass: top objectclass: person cn: you sn: Lastname userPassword: {crypt}XXXXXXX My slapd.conf... # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # # # Allow users to authenticate access to attrs=userPassword by self write by anonymous auth # Allow authenticated users access to their own address book access to dn.regex="o=(.+),ou=AddressBooks,dc=University,dc=edu" by users.expand="cn=$1,ou=Users,dc=University,dc=edu" write # Allow authenticated users to read the resource to which # they have access by logging in with an empty Bind DN access to dn.base="ou=AddressBooks,dc=University,dc=edu" by * read access to dn.base="" by * read # Allow authenticated users to read the Subschema of the # resources to which they have access access to dn.base="cn=Subschema" by * read # Disallow anonymous access (binds) # With this policy in effect, unathenticated users receive a response of # Error 48: Inappropiate authentication disallow bind_anon # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=University,dc=edu" rootdn "cn=root,dc=University,dc=edu" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq Thanks ------------------- david stackis uc santa barbara

1 0

id returns no such user
by Stelios A. 28 Jul '08

28 Jul '08

Hello, I have 2 servers, one act as master and other as slave syncing data with syncrepl user without a problem. Suddenly and after adding an index to the slapd.conf (the problem is probably somewhere else but just mentioning the last thing that I did) on the slave server where email is running I'm getting a: id: shipsec: No such user wherever I'm trying to see a users details. Then webmail, pop etc are not working because machine is not able to resolve the users from ldap. Howver, the getent passwd command return with all users from ldap like been local without a problem. All users under /home are like 1700:users insteed of username:users. The problem is only at the slave as If I stop the ldap on the slave then everything works as it use the master for getting the ids. Any idea? -- Stelios A

3 2

Re: N-way multimaster
by Miguel Jinez 25 Jul '08

25 Jul '08

Yes, deletes are performed in one node 2008/7/25 Gavin Henry <ghenry(a)openldap.org> > <quote who="Miguel Jinez"> > > Sorry I have a mistake, changing words: > > It should be like this: > > > > syncrepl rid=001 > > provider=ldap://10.100.130.164 > > type=refreshAndPersist > > retry="5 5 300 +" > > searchbase="dc=dominio" > > attrs="*" > > bindmethod=simple > > binddn="cn=admin,dc=dominio" > > credentials=secret > > > > syncrepl rid=002 > > provider=ldap://10.100.130.181 > > type=refreshAndPersist > > retry="5 5 300 +" > > searchbase="dc=dominio" > > attrs="*" > > bindmethod=simple > > binddn="cn=admin,dc=dominio" > > credentials=secret > > > > mirrormode TRUE > > > > In addition when I add "schemachecking=on" syncrinization doesn't works. > > > > With the configurations file that I have made, works adds, updates, but > no > > deletes > > Can you confirm deletes work on one node? > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ >

1 0

Re: N-way multimaster
by Miguel Jinez 25 Jul '08

25 Jul '08

Sorry I have a mistake, changing words: It should be like this: syncrepl rid=001 provider=ldap://10.100.130.164 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=dominio" attrs="*" bindmethod=simple binddn="cn=admin,dc=dominio" credentials=secret syncrepl rid=002 provider=ldap://10.100.130.181 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=dominio" attrs="*" bindmethod=simple binddn="cn=admin,dc=dominio" credentials=secret mirrormode TRUE In addition when I add "schemachecking=on" syncrinization doesn't works. With the configurations file that I have made, works adds, updates, but no deletes 2008/7/25 Gavin Henry <ghenry(a)openldap.org> > Miguel Jinez wrote: > >> Hello, yes "dies" means shutdown >> I have made some changes in my config file, but the problem is the same, >> now I'm with openladap-2.4.11. >> Here my config file: >> Master A >> slapd.conf >> >> # Global Directives: >> # Schema and objectClass definitions >> include /etc/ldap/schema/core.schema >> include /etc/ldap/schema/cosine.schema >> include /etc/ldap/schema/nis.schema >> include /etc/ldap/schema/inetorgperson.schema >> include /etc/ldap/schema/samba.schema >> >> pidfile /var/run/slapd/slapd.pid >> argsfile /var/run/slapd/slapd.args >> loglevel 256 >> sizelimit 500 >> tool-threads 1 >> >> backend bdb >> >> database bdb >> suffix "dc=ar" >> >> overlay syncprov >> syncprov-sessionlog 100 >> syncprov-nopresent TRUE >> syncprov-reloadhint TRUE >> syncprov-checkpoint 1 1 >> rootdn "cn=admin,dc=dominio" >> rootpw secret >> >> directory "/usr/local/var/openldap-data" >> >> dbconfig set_cachesize 0 2097152 0 >> >> dbconfig set_lk_max_objects 1500 >> dbconfig set_lk_max_locks 1500 >> dbconfig set_lk_max_lockers 1500 >> >> index cn,sn,uid pres,sub,eq >> index uidNumber,gidNumber eq >> index sambaSID eq >> index sambaPrimaryGroupSID eq >> index sambaDomainName eq >> index objectClass pres,eq >> >> lastmod on >> access to attrs=userPassword,shadowLastChange >> by dn="cn=admin,dc=ar" write >> by anonymous auth >> by self write >> by * none >> access to * >> by dn="cn=admin,dc=ar" write >> by * read >> >> access to * >> by dn.base="cn=admin,dc=ar" read >> by * break >> serverID 3 >> >> syncrepl rid=001 >> provider=ldap://10.100.130.164 <http://10.100.130.164> >> type=refreshAndPersist >> retry="5 5 300 +" >> searchbase="dc=ar" >> attrs="*" >> bindmethod=simple >> binddn="cn=admin,dc=ar" >> credentials=osde >> > > Are you searching for the right attributes here? Just use the defaults like > in the docs: > > syncrepl rid=001 > provider=ldap://ldap-ridr1.example.com > bindmethod=simple > binddn="cn=mirrormode,dc=example,dc=com" > credentials=mirrormode > searchbase="dc=example,dc=com" > schemachecking=on > type=refreshAndPersist > retry="60 +" > > > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ >

1 0

Re: openLDAP, DCHP and DNS
by Bjørn Ruberg 25 Jul '08

25 Jul '08

On Wed, 23 Jul 2008 07:56:44 -0700, "Lawrence Anthony" <lanthony(a)postlogic.com> wrote: > Is there any documentation that you can point me too that explains this to > me? I need to make management understand. Most primers and/or SSL/TLS howtos should cover this, as it is rather essential for making certificates work. A Google search will help you :-) And please post/quote correctly, i.e. stop top-posting. It breaks context and readability. See http://www.greenend.org.uk/rjk/2000/06/14/quoting.html for further information. -- Bjørn

1 0

Setting up syncrepl, replicated LDAP doesn't work
by John Oliver 25 Jul '08

25 Jul '08

On my working master server openldap-2.3.27-8 under CentOS 5, I added: overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 On the slave server openldap-2.3.27-8.el5_2.4 under CentOS 5.2, I added: syncrepl rid=123 provider=ldaps://primary-ldap-server:636 type=refreshOnly interval=01:00:00:00 searchbase="dc=mydomain,dc=com" filter="(objectClass=*)" scope=sub attrs="*" schemachecking=off bindmethod=simple binddn="cn=syncuser,dc=mydomain,dc=com" credentials=mysecret ldap started on the slave server OK, and /var/lib/ldap has all of the database files. On that server, from the command line, I can: [root@ldap2 ~]# ldapsearch -xLLL -b "dc=mydomain,dc=com" uid=joliver sn givenName cn dn: uid=joliver,ou=People,dc=mydomain,dc=com givenName: John sn: Oliver cn: John Oliver But when I point another machine at that slave server, it won't authenticate: Jul 23 03:06:28 localhost login(pam_unix)[9475]: check pass; user unknown Jul 23 03:06:28 localhost login(pam_unix)[9475]: authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost= Jul 23 03:06:28 localhost login[9475]: pam_ldap: ldap_search_s No such object Jul 23 03:06:30 localhost login[9475]: FAILED LOGIN 1 FROM (null) FOR joliver, Authentication failure [root@localhost ~]# ldapsearch -H ldaps://ldap2.mydomain.com -b "dc=mydomain,dc=com" uid=joliver sn givenName cn ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed [root@localhost ~]# ldapsearch -H ldap://ldap2.mydomain.com -b "dc=mydomain,dc=com" uid=joliver sn givenName cn SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database When using just ldap:// with ldapsearch, I don't know what password it's asking for. My LDAP password doesn't work, the LDAP admin password doesn't work, the local root password doesn't work... Here's the odd thing. When I started setting this up, the machine that's the primary (and working) LDAP server now was running fedora-ds. I set up OpenLDAP on what is now the slave server, and it worked perfectly. I slapcat'ed it, installed OpenLDAP on the primary server, and slapadded the db. I never generated any certificates on it at all, and it works perfectly. I just regenerated the cert on the slave server, but no joy. -- *********************************************************************** * John Oliver http://www.john-oliver.net/ * * * ***********************************************************************

2 1

mailHost
by Aravind Arjunan 25 Jul '08

25 Jul '08

hi, i had configured openldap in RHEL 5.1 operating system as master/slave for replication. It is working fine without any problem I had integrated openldap with my mailserver. mail server is in RHEL 5.1 OS and am using postfix. I have two mail box server in different location and two mail servers. unique users are existing in different mail servers The problem is when mail comes for a particular user it must go the respective mail box server. For that i need to mention in openldap a mailHost attribute. as you all know mailHost attribute is for specifying the location of mailbox. But in openldap misc.schema mailHoat attribute exits. When i add the misc.schema in slapd.conf file and if i add the mailHost attribute am getting error when i was restarting. And i had downloaded the qmail.schema from google and added that in schema directory as well as in slapd.conf Then i added the mailHost attribute. But when i specify the mailHost attribute as IP of my mailbox location, the mail is dropping by creating the IP as name.

2 1

Single master/multislave and passwords
by Bryan Payne 23 Jul '08

23 Jul '08

Our master is in dallas. One slave is in ohio. Our ohio users bind to their local server for speed's sake. This is obviously a problem if they change their password. Is there a way to bind locally but when it comes to updating passwords, it inform the master instead?

2 1

Re: N-way multimaster
by Miguel Jinez 23 Jul '08

23 Jul '08

Hello, yes "dies" means shutdown I have made some changes in my config file, but the problem is the same, now I'm with openladap-2.4.11. Here my config file: Master A slapd.conf # Global Directives: # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 256 sizelimit 500 tool-threads 1 backend bdb database bdb suffix "dc=ar" overlay syncprov syncprov-sessionlog 100 syncprov-nopresent TRUE syncprov-reloadhint TRUE syncprov-checkpoint 1 1 rootdn "cn=admin,dc=dominio" rootpw secret directory "/usr/local/var/openldap-data" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index cn,sn,uid pres,sub,eq index uidNumber,gidNumber eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index objectClass pres,eq lastmod on access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=ar" write by anonymous auth by self write by * none access to * by dn="cn=admin,dc=ar" write by * read access to * by dn.base="cn=admin,dc=ar" read by * break serverID 3 syncrepl rid=001 provider=ldap://10.100.130.164 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=ar" attrs="*" bindmethod=simple binddn="cn=admin,dc=ar" credentials=osde syncrepl rid=002 provider=ldap://10.100.130.181 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=ar" attrs="*" bindmethod=simple binddn="cn=admin,dc=dominio" credentials=secret mirrormode TRUE ##Accesslog overlay overlay accesslog logdb "cn=accesslog" logops writes logold (objectclass=auditModify) logoldattr reqOld logold (objectclass=auditDelete) logoldattr reqOld logsuccess TRUE logpurge 2+00:00 06:00 ##AccessLog DB database bdb suffix cn=accesslog rootdn "cn=accesslog" directory "/usr/local/var/access" index reqStart eq index default eq index entryUUID eq index entryCSN eq index objectClass,reqEnd,reqResult,reqDN,reqType access to * by dn="cn=admin,dc=dominio" read database monitor #******* 2008/7/23 Gavin Henry <ghenry(a)openldap.org>: > Miguel Jinez wrote: > >> Hello, I have upgrated openLDAP to 2.4.10, and I can t fix that situation >> Someone know what is the problem? or really is a bug? >> >> > Hi, > > I'm replying to this thread instead of: > > (ITS#5617) N-way multimaster replication problem > > Can we see your complete config? Also, "dies", do you mean shutdown? > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ >

1 0

openLDAP, DCHP and DNS
by openLDAP 23 Jul '08

23 Jul '08

I would like to configure my openLDAP network using DHCP for my client machines. Is it necessary to have DNS names for all my clients, e.g. something.domain.com, for OpenLDAP to work properly or will it work as long as my openldap servers have fully qualified domain names?

2 1

Re: Client connect issues with OpenLDAP 2.3 on RHEL 4
by Gustavo Mendes de Carvalho 23 Jul '08

23 Jul '08

Hi Martin, Upgrade your RHEL from 4 to 5 that will work. I faced exactly same situation earlier. --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com > Date: Mon, 21 Jul 2008 18:33:42 +0100 > From: "Martin Benson" <martin_benson1972(a)hotmail.com> > Subject: Client connect issues with OpenLDAP 2.3 on RHEL 4 > To: <openldap-technical(a)openldap.org> > Message-ID: <BLU120-DAV199BFEDE2D0B7E6F309718B8A0(a)phx.gbl> > Content-Type: text/plain; charset="us-ascii" > > I have a Red Hat Enterprise Linux v4.4 installation that runs OpenLDAP 2.2 > using the provided Red Hat rpm's. I want to upgrade this to OpenLDAP 2.3 and > have created an LDAP server using the packages from > > > Thanks Martin

1 0

password changing problems
by Ron Echeverri 22 Jul '08

22 Jul '08

I've set up OpenLDAP 2.4.10 and have been using phpldapadmin for user management. The machines in our QA environment are set up to allow LDAP users to log in, and they are also able to change their password via the passwd command. However, they are only able to do this once; if they attempt it again, it bounces back with "LDAP Password incorrect: try again". They are able to log out and in regardless, but passwd will not accept their password in order to change it. If the user's password is reset in phpldapadmin, again they are able to change the password once, and no more. There is no password policy configured in slapd; should there be? I have loglevel set to 296, but i'm not sure what to look for. thanks rone

5 8

Automatically create home directory uppon Email login
by Stelios A. 22 Jul '08

22 Jul '08

Hello all, I've migrate an old Sun Directory Server to OpenLDAP (version 2.4.9 on Ubuntu 8.04 server) and setup a master/slave with syncrepl for data replication betwwen 2 servers. 1st server hold the master ldap and second the slave along with the email server (Sendmail + Dovecot). Email server requires ofcourse a home directory with a mbox file etc. Is there a way to avoid creating each users home directory and setup then his/her permissions? There are 980 users in the base dc and trying to figure out a way to avoid creating all this directories along with chmod manually. I've already setup pam to auto create home directory uppon user login but problem is that only 5 users will have access via ssh. Any ideas? Thanks a lot

3 4

Client connect issues with OpenLDAP 2.3 on RHEL 4
by Martin Benson 22 Jul '08

22 Jul '08

I have a Red Hat Enterprise Linux v4.4 installation that runs OpenLDAP 2.2 using the provided Red Hat rpm's. I want to upgrade this to OpenLDAP 2.3 and have created an LDAP server using the packages from http://staff.telkomsa.net/packages/rhel4/openldap/i386 . The problem I have is that I cannot get a client to attach or query the server. I have installed the openldap2.3-clients and openldap2.3 packages and the server with logging enabled does not even show a connection. I suspect it is a problem with the nss_ldap package that comes bundled with RHEL 4.4. I cannot compile the software on my system as it is a partial install for clients of ours and does not get delivered with compiler software. Does anyone know of an updated rpm for nss_ldap to be compatible with openldap2.3 and RHEL 4? Has anyone done the install and written an install guide? Thanks Martin

2 1

Reg:Design of openldap
by Chakri 21 Jul '08

21 Jul '08

Hi, i'm a newbie to this ldap world.But i have been spending so much time to understand the design of openldap-2.3.39. I wanted to understand the process flow during the functioning of slapd. can some one tell me where can i get the design documents of openldap....plz help...

1 0

memberOf search ACLs
by Andrew Bartlett 21 Jul '08

21 Jul '08

I've recently been trying to lock down Samba4's default ACLs, in it's generated LDAP backend configuration. I have memberOf configured to 'error' on dangling links, which I need for Samba. But I seem to be having some trouble with ACLs. I've attached my full config file, but the key part is: access to dn.base="" by dn=cn=samba-admin,cn=samba manage by anonymous read by * read access to dn.subtree="cn=samba" by anonymous auth access to dn.subtree="${DOMAINDN}" by dn=cn=samba-admin,cn=samba manage by * none If I change the last line to 'by * read', then the error is returned, but otherwise (due apparently to "" being unable to read the entry to validate it's existence). Shouldn't the search operations happen as the rootdn or memberof-dn, or am I missing some other configuration element here? In trying to fix this, I looked at what seemed to by typos in memberof.c, the patch of which I attach, but this didn't help. Any thoughts? Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

2 5

Re: BDB selection, et al.
by William Jojo 20 Jul '08

20 Jul '08

---- Original message ---- >Date: Sat, 19 Jul 2008 04:33:46 -0700 >From: Howard Chu <hyc(a)symas.com> >Subject: Re: BDB selection, et al. >To: Quanah Gibson-Mount <quanah(a)zimbra.com> >Cc: William Jojo <jojowil(a)hvcc.edu>,openldap-technical(a)openldap.org > >Quanah Gibson-Mount wrote: >> --On Friday, July 18, 2008 9:11 PM -0400 William Jojo<jojowil(a)hvcc.edu> >> wrote: > >>> I have noticed that the Symas packages user BDB 4.2 (with 2.3.42) as does >>> Ubuntu with 2.4.9+. I was wondering what the preference is over 4.4 >>> (which I use) and 4.[67]. >> >> 4.2.52 + patches has the longest history of being solid. >> >> 4.3 was a disaster >> >> 4.4 was likely okay >> >> 4.5 was likely okay >> >> 4.6 also seems okay, and has some useful improvements >> >> 4.7 is not yet supported, but will be in a future release, and has >> additional useful improvements over 4.6. > >4.7 can be made to work, if you're willing to tweak things a bit. The memory >manager in 4.6 is much improved over earlier versions; the memory manager in >4.7 is slightly better still. The lock manager in 4.7 is more efficient in >multi-core systems than in previous versions. > Do you, Howard, consider BDB 4.4 stable? I originally worked on 4.2 for initial rollout some years ago. Admittedly, I have no problems at present with 4.4, and I could be convinced to step backward if there is a compelling reason to do so. >>> I ask because I build OpenLDAP (among other things) for AIX 5.2/5.3/6.1 >>> at (shameless plug) http://pware.hvcc.edu/ and I was considering moving >>> to 2.4.10 with BDB 4.6, but now I am not certain where to go for a few of >>> reasons: >>> >>> * Why the choice to stay with BDB 4.2? >> >> Proven track record over later releases (4.4, 4.5) for stability and >> performance. >> >>> * And OpenSSL 0.9.7l (over the 0.9.8 series)? >> >> I use OpenSSL 0.9.8 in my builds and have for ages. > >The Symas OpenLDAP 2.4 packages also use OpenSSL 0.9.8. However, the OpenSSL >build system changed, making it more difficult to complete the Windows build. >That's one of the reasons we stayed with 0.9.7 for so long in our OpenLDAP 2.3 >packages. >> >>> * 2.3.39 has been *stable* since 11/2007 and I have not moved from that >>> point within the software suite offered. Is a later version of 2.3 going >>> to be marked stable (like 2.3.42.1 is in the Symas prodcut). >> >> Not likely. > >True, no further 2.3.x release will be marked Stable. > >> Stable is really a fairly meaningless term. > >False. At the time that a release was marked stable, it was considered the >most stable release. I.e., after sufficient amount of time in release, no >major issues were discovered. > >> Assigning meaning >> to it as a guideline as to what version to build is a very bad idea. >> There's a major DoS vulnerability in 2.3.39, for example, that was fixed in >> 2.3.43 and 2.4.11. > >It's important to note that the Stable marker only changes if there's a new >release that we consider stable. The subsequent discovery of bugs in a Stable >release won't trigger the removal of that marker. So 2.3.39 is still marked >Stable, even though important bug fixes are in 2.3.43, because those bugs were >discovered long after 2.3.39 was released. > So, I guess I will stay where I am in production and prepare for a 2.4 upgrade at some soon time after I finish my testing in 2.4 and when a stable release is announced. >In the meantime, when moving the Stable marker, the Project's practice has >been that it can only be moved to the Current release stream, which is 2.4. >But we haven't yet seen a 2.4 release remain long enough in public use without >new issues quickly being discovered. So there is not yet a new Stable release. > >>> * 2.4.x seems stable enough to me and certainly to Ubuntu x86[_64], but I >>> would like some other indication that I should make the leap before I >>> begin to change dependencies to several of the products I produce. Is >>> 2.4.x going to be marked stable in the near future? > >> Hopefully. Note that stable does not remotely mean bug free (or relatively >> low in bug count). It simply means stable as far as core (i.e., not new) >> functionality is concerned. > >No. It means low bug count as of a particular point in time, e.g., within a >couple weeks after the release. > >And as I recall, we need to get to a feature freeze in the core code first. I >think 2.4 is just about at this point now. > Superb. Thank you very much, Quanah and Howard. It has been a very enlightening discussion. Cheers, Bill >-- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ >

1 0

Please help me with ppolicy pwdReset
by Scott Classen 20 Jul '08

20 Jul '08

Hi All, this is my default ppolicy: dn: cn=default,ou=Policies,dc=example,dc=com objectClass: pwdPolicy objectClass: top objectClass: device pwdAttribute: userPassword pwdMaxFailure: 3 pwdFailureCountInterval: 0 pwdAllowUserChange: TRUE cn: default pwdSafeModify: FALSE pwdExpireWarning: 0 pwdInHistory: 1 pwdMinLength: 7 pwdGraceAuthNLimit: 1 pwdLockout: TRUE pwdLockoutDuration: 300 pwdMaxAge: 63072000 pwdCheckQuality: 2 pwdMustChange: TRUE pwdMinAge: 0 Here is an example of a user with their pwdReset attribute set to TRUE. I've only included the relevant lines: dn: uid=newguy,ou=People,dc=example,dc=com pwdChangedTime: 20080718234642Z pwdReset: TRUE pwdPolicySubentry: cn=default,ou=Policies,dc=example,dc=com Shouldn't this user be requested to change their password the next time the log in? Well they're not. logins a successful and there is no prompting for a new password. Can someone please help me trouble shoot this? Thanks, Scott

1 1

RES: ppolicy woes
by Gustavo Mendes de Carvalho 19 Jul '08

19 Jul '08

Hi Bob, Some months ago I had similar problem trying to use Password Policy. I was using RHAS4 Up6, and my client machines was using RHES4 Up2, and for some unknown reason, no matter waht configuration I did, client machines did not recognizes ppolicy arguments sent from ldap server. I just solved this situation doing some upgrade in client machines, from Up2 to Up5. After this upgrade, everithing was OK. Did you try this client configuration in some other linux distribution ? --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com

1 0

BDB selection, et al.
by William Jojo 19 Jul '08

19 Jul '08

I have noticed that the Symas packages user BDB 4.2 (with 2.3.42) as does Ubuntu with 2.4.9+. I was wondering what the preference is over 4.4 (which I use) and 4.[67]. I ask because I build OpenLDAP (among other things) for AIX 5.2/5.3/6.1 at (shameless plug) http://pware.hvcc.edu/ and I was considering moving to 2.4.10 with BDB 4.6, but now I am not certain where to go for a few of reasons: * Why the choice to stay with BDB 4.2? * And OpenSSL 0.9.7l (over the 0.9.8 series)? * 2.3.39 has been *stable* since 11/2007 and I have not moved from that point within the software suite offered. Is a later version of 2.3 going to be marked stable (like 2.3.42.1 is in the Symas prodcut). * 2.4.x seems stable enough to me and certainly to Ubuntu x86[_64], but I would like some other indication that I should make the leap before I begin to change dependencies to several of the products I produce. Is 2.4.x going to be marked stable in the near future? I appreciate all of the work of the OpenLDAP team and the community. I welcome any suggestions to help me make the right decision. In the meantime, my own production servers remain at 2.3.39-stable, but I can be persuaded to upgrade. :-) Cheers, Bill

3 2

ppolicy woes
by Robert Evans 18 Jul '08

18 Jul '08

Greetings, I've been trying to get openldap working with the ppolicy stuff for the last week. I think I've got things setup correctly, but the account lockout stuff isn't working and I can't figure out what I've done wrong. I've attached below the slapd.conf, ldap.conf and the ldif file I used to set up the test server. I'm relatively inexperienced in LDAP so I double checked things, but maybe.... If I include the ACL access part in the slapd.conf file (shown below), I can't ssh into a client that is using the server to authenticate. If I remove the access section, I can connect just fine, but then it authenticates me even though an ldapsearch with the -e ppolicy flag shows "ldap_bind: Invalid credentials (49); Account locked" I'm running openldap 2.3.39 on Cent OS 5.0. I'm starting ldap with the -d -1 option and don't see any error messages. Any suggestions? Thanks, Bob ================================ Below are the files used to populate the ppolicy attributes, and the slapd.conf and ldap.conf files on the server. =============================== 1) The following was used to populate the LDAP server, with the top level objects and the ppolicy values =============================== dn: dc=foo,dc=bar,dc=edu objectClass: top objectClass: organization objectClass: dcObject o: foo dc: foo dn: ou=People, dc=foo,dc=bar,dc=edu objectClass: top objectClass: organizationalUnit ou: People dn: ou=Group,dc=foo,dc=bar,dc=edu objectClass: top objectclass: organizationalUnit ou: Group dn: ou=Policies, dc=foo,dc=bar,dc=edu objectClass: top objectClass: organizationalUnit ou: Policies dn: cn=Standard Policy, ou=Policies, dc=foo,dc=bar,dc=edu objectClass: top objectClass: device objectClass: pwdPolicy cn: Standard Policy pwdAttribute: 2.5.4.35 # min passwd change of 7 days pwdMinAge: 604800 # max passwd change of 90 days pwdMaxAge: 7776000 # expire warning in 7 days pwdExpireWarning: 604800 # Can't reuse the last 24 passwords pwdInHistory: 24 # the server must verify the new passwd for changes to be made pwdCheckQuality: 2 # min passwd length pwdMinLength: 8 # Number of failed passwd attempts before lockout pwdMaxFailure: 3 # lockout user for failed attempts pwdLockout: TRUE # only lockout user for 15 minutes pwdLockoutDuration: 900 # Do not allow expired passwd's to access system pwdGraceAuthNLimit: 0 # only reset passwd attempt count on successful login pwdFailureCountInterval: 0 # specifies user must change passwd after admin has reset it pwdMustChange: TRUE # users can change their passwords pwdAllowUserChange: TRUE # Allows the user to change their passwd without typing in the old. pwdSafeModify: TRUE =============================== 2) Here is the slapd.conf file =============================== # master slapd config -- for testing # $OpenLDAP: pkg/ldap/tests/data/slapd-ppolicy.conf,v 1.6.2.7 2007/01/02 21:44:12 kurt Exp $ ## This work is part of OpenLDAP Software <http://www.openldap.org/>. ## ## Copyright 1998-2007 The OpenLDAP Foundation. ## All rights reserved. ## ## Redistribution and use in source and binary forms, with or without ## modification, are permitted only as authorized by the OpenLDAP ## Public License. ## ## A copy of this license is available in the file LICENSE in the ## top-level directory of the distribution or, alternatively, at ## <http://www.OpenLDAP.org/license.html>. include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/ppolicy.schema pidfile /var/lib/ldap/run/slapd.pid argsfile /var/lib/ldap/run/slapd.args #mod#modulepath ../servers/slapd/back-bdb/ #mod#moduleload back_bdb.la #monitormod#modulepath ../servers/slapd/back-monitor/ #monitormod#moduleload back_monitor.la modulepath /usr/sbin/openldap/ moduleload ppolicy.la ####################################################################### # database definitions ####################################################################### database bdb suffix "dc=foo,dc=bar,dc=edu" directory /var/lib/ldap/openldap-data rootdn "cn=Manager,dc=foo,dc=bar,dc=edu" rootpw {SSHA}<root slappasswd went here> index objectClass eq #hdb#index objectClass eq #ldbm#index objectClass eq overlay ppolicy ppolicy_default "cn=Standard Policy,ou=Policies,dc=foo,dc=bar,dc=edu" ppolicy_use_lockout access to attr=userPassword by self write by anonymous auth by dn.base="cn=Admin,dc=foo,dc=bar,dc=edu" write by dn.base="cn=Manager,dc=foo,dc=bar,dc=edu" write by * none access to * by self write by dn.base="cn=Admin,dc=foo,dc=bar,dc=edu" write by dn.base="cn=Manager,dc=foo,dc=bar,dc=edu" write by * read #database monitor ================================================== 3) Here is the ldap.conf file on the client and server ================================================== # @(#)$Id: ldap.conf,v 1.38 2006/05/15 08:13:31 lukeh Exp $ # # This is the configuration file for the LDAP nameservice # switch library and the LDAP PAM module. # # The man pages for this file are nss_ldap(5) and pam_ldap(5) # # PADL Software # http://www.padl.com # # Your LDAP server. Must be resolvable without using LDAP. # Multiple hosts may be specified, each separated by a # space. How long nss_ldap takes to failover depends on # whether your LDAP client library supports configurable # network or connect timeouts (see bind_timelimit). host 127.0.0.1 # The distinguished name of the search base. base dc=foo,dc=bar,dc=edu # Another way to specify your LDAP server is to provide an # uri with the server name. This allows to use # Unix Domain Sockets to connect to a local LDAP Server. #uri ldap://127.0.0.1/ #uri ldaps://127.0.0.1/ #uri ldapi://%2fvar%2frun%2fldapi_sock/ # Note: %2f encodes the '/' used as directory separator # The LDAP version to use (defaults to 3 # if supported by client library) #ldap_version 3 # The distinguished name to bind to the server with. # Optional: default is to bind anonymously. #binddn cn=proxyuser,dc=example,dc=com # The credentials to bind with. # Optional: default is no credential. #bindpw secret # The distinguished name to bind to the server with # if the effective user ID is root. Password is # stored in /etc/ldap.secret (mode 600) rootbinddn cn=Manager,dc=foo,dc=bar,dc=edu # The port. # Optional: default is 389. port 389 # The search scope. #scope sub #scope one #scope base # Search timelimit #timelimit 30 timelimit 120 # Bind/connect timelimit #bind_timelimit 30 bind_timelimit 120 # Reconnect policy: hard (default) will retry connecting to # the software with exponential backoff, soft will fail # immediately. #bind_policy hard # Idle timelimit; client will close connections # (nss_ldap only) if the server has not been contacted # for the number of seconds specified below. #idle_timelimit 3600 idle_timelimit 3600 # Filter to AND with uid=%s #pam_filter objectclass=account # The user ID attribute (defaults to uid) #pam_login_attribute uid # Search the root DSE for the password policy (works # with Netscape Directory Server) pam_lookup_policy yes # Check the 'host' attribute for access control # Default is no; if set to yes, and user has no # value for the host attribute, and pam_ldap is # configured for account management (authorization) # then the user will not be allowed to login. #pam_check_host_attr yes # Check the 'authorizedService' attribute for access # control # Default is no; if set to yes, and the user has no # value for the authorizedService attribute, and # pam_ldap is configured for account management # (authorization) then the user will not be allowed # to login. #pam_check_service_attr yes # Group to enforce membership of #pam_groupdn cn=PAM,ou=Groups,dc=example,dc=com # Group member attribute #pam_member_attribute uniquemember # Specify a minium or maximum UID number allowed #pam_min_uid 0 #pam_max_uid 0 # Template login attribute, default template user # (can be overriden by value of former attribute # in user's entry) #pam_login_attribute userPrincipalName #pam_template_login_attribute uid #pam_template_login nobody # HEADS UP: the pam_crypt, pam_nds_passwd, # and pam_ad_passwd options are no # longer supported. # # Do not hash the password at all; presume # the directory server will do it, if # necessary. This is the default. #pam_password clear # Hash password locally; required for University of # Michigan LDAP server, and works with Netscape # Directory Server if you're using the UNIX-Crypt # hash mechanism and not using the NT Synchronization # service. #pam_password crypt # Remove old password first, then update in # cleartext. Necessary for use with Novell # Directory Services (NDS) #pam_password clear_remove_old #pam_password nds # RACF is an alias for the above. For use with # IBM RACF #pam_password racf # Update Active Directory password, by # creating Unicode password and updating # unicodePwd attribute. #pam_password ad # Use the OpenLDAP password change # extended operation to update the password. #pam_password exop # Redirect users to a URL or somesuch on password # changes. #pam_password_prohibit_message Please visit http://internal to change your password. # RFC2307bis naming contexts # Syntax: # nss_base_XXX base?scope?filter # where scope is {base,one,sub} # and filter is a filter to be &'d with the # default filter. # You can omit the suffix eg: # nss_base_passwd ou=People, # to append the default base DN but this # may incur a small performance impact. #nss_base_passwd ou=People,dc=example,dc=com?one #nss_base_shadow ou=People,dc=example,dc=com?one #nss_base_group ou=Group,dc=example,dc=com?one #nss_base_hosts ou=Hosts,dc=example,dc=com?one #nss_base_services ou=Services,dc=example,dc=com?one #nss_base_networks ou=Networks,dc=example,dc=com?one #nss_base_protocols ou=Protocols,dc=example,dc=com?one #nss_base_rpc ou=Rpc,dc=example,dc=com?one #nss_base_ethers ou=Ethers,dc=example,dc=com?one #nss_base_netmasks ou=Networks,dc=example,dc=com?ne #nss_base_bootparams ou=Ethers,dc=example,dc=com?one #nss_base_aliases ou=Aliases,dc=example,dc=com?one #nss_base_netgroup ou=Netgroup,dc=example,dc=com?one # Just assume that there are no supplemental groups for these named users nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon # attribute/objectclass mapping # Syntax: #nss_map_attribute rfc2307attribute mapped_attribute #nss_map_objectclass rfc2307objectclass mapped_objectclass # configure --enable-nds is no longer supported. # NDS mappings #nss_map_attribute uniqueMember member # Services for UNIX 3.5 mappings #nss_map_objectclass posixAccount User #nss_map_objectclass shadowAccount User #nss_map_attribute uid msSFU30Name #nss_map_attribute uniqueMember msSFU30PosixMember #nss_map_attribute userPassword msSFU30Password #nss_map_attribute homeDirectory msSFU30HomeDirectory #nss_map_attribute homeDirectory msSFUHomeDirectory #nss_map_objectclass posixGroup Group #pam_login_attribute msSFU30Name #pam_filter objectclass=User #pam_password ad # configure --enable-mssfu-schema is no longer supported. # Services for UNIX 2.0 mappings #nss_map_objectclass posixAccount User #nss_map_objectclass shadowAccount user #nss_map_attribute uid msSFUName #nss_map_attribute uniqueMember posixMember #nss_map_attribute userPassword msSFUPassword #nss_map_attribute homeDirectory msSFUHomeDirectory #nss_map_attribute shadowLastChange pwdLastSet #nss_map_objectclass posixGroup Group #nss_map_attribute cn msSFUName #pam_login_attribute msSFUName #pam_filter objectclass=User #pam_password ad # RFC 2307 (AD) mappings #nss_map_objectclass posixAccount user #nss_map_objectclass shadowAccount user #nss_map_attribute uid sAMAccountName #nss_map_attribute homeDirectory unixHomeDirectory #nss_map_attribute shadowLastChange pwdLastSet #nss_map_objectclass posixGroup group #nss_map_attribute uniqueMember member #pam_login_attribute sAMAccountName #pam_filter objectclass=User #pam_password ad # configure --enable-authpassword is no longer supported # AuthPassword mappings #nss_map_attribute userPassword authPassword # AIX SecureWay mappings #nss_map_objectclass posixAccount aixAccount #nss_base_passwd ou=aixaccount,?one #nss_map_attribute uid userName #nss_map_attribute gidNumber gid #nss_map_attribute uidNumber uid #nss_map_attribute userPassword passwordChar #nss_map_objectclass posixGroup aixAccessGroup #nss_base_group ou=aixgroup,?one #nss_map_attribute cn groupName #nss_map_attribute uniqueMember member #pam_login_attribute userName #pam_filter objectclass=aixAccount #pam_password clear # Netscape SDK LDAPS #ssl on # Netscape SDK SSL options #sslpath /etc/ssl/certs # OpenLDAP SSL mechanism # start_tls mechanism uses the normal LDAP port, LDAPS typically 636 #ssl start_tls #ssl on # OpenLDAP SSL options # Require and verify server certificate (yes/no) # Default is to use libldap's default behavior, which can be configured in # /etc/openldap/ldap.conf using the TLS_REQCERT setting. The default for # OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes". #tls_checkpeer yes # CA certificates for server certificate verification # At least one of these are required if tls_checkpeer is "yes" #tls_cacertfile /etc/ssl/ca.cert #tls_cacertdir /etc/ssl/certs # Seed the PRNG if /dev/urandom is not provided #tls_randfile /var/run/egd-pool # SSL cipher suite # See man ciphers for syntax #tls_ciphers TLSv1 # Client certificate and key # Use these, if your server requires client authentication. #tls_cert #tls_key # Disable SASL security layers. This is needed for AD. #sasl_secprops maxssf=0 # Override the default Kerberos ticket cache location. #krb5_ccname FILE:/etc/.ldapcache # SASL mechanism for PAM authentication - use is experimental # at present and does not support password policy control #pam_sasl_mech DIGEST-MD5

2 1

schema
by John Kellen 18 Jul '08

18 Jul '08

Hello, what schema do i need to have configured in slapd.conf to use this ldif file: *dn: cn=aderaede,ou=People,dc=vub,dc=ac,dc=be objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: inetLocalMailRecipient objectClass: shadowAccount uid: aderaede sn: *********** givenName: Anouk cn: aderaede userPassword: {crypt}WZpdKybON0LAQ loginShell: /bin/csh uidNumber: 25556 gidNumber: 3294 homeDirectory: /u/aderaede gecos: *************** mail: ************* displayName: *************** ** I have the following configured in slapd.conf *# Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/openldap.schemaµ* Thanks J

3 5

Problem deleting item because of DB_LOCK_NOTGRANTED
by Laurent Bourqui 18 Jul '08

18 Jul '08

Dear Openldap techies, I have been trying for hours to bring this server to work without any success so far. When I try to delete an object from the ldap server with ldapdelete, I get the following error message in the log file: Jul 18 00:43:00 zorg slapd[1904]: => bdb_dn2id_delete 0x3: "cn=laurent bourqui,ou=addresses,dc=apicus,dc=ch" Jul 18 00:43:00 zorg slapd[1904]: <= bdb_dn2id_delete 0x3: -30994 Jul 18 00:43:00 zorg slapd[1904]: <=- bdb_delete: dn2id failed: DB_LOCK_NOTGRANTED: Lock not granted (-30994) Jul 18 00:43:00 zorg slapd[1904]: ==> bdb_delete: retrying... The server is configured the following way: sladpd.conf: ------------------------ include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/local/libexec/openldap moduleload back_bdb loglevel any ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=apicus,dc=ch" rootdn "cn=admin,dc=apicus,dc=ch" rootpw xxxxxxxx directory /var/db/openldap-data index objectClass eq ---------------------------------------- I have added some entries using the following ldif file: ---------------------------------------- dn: dc=apicus, dc=ch objectclass: dcObject objectClass: organization o: apicus dc: apicus dn: ou=addresses, dc=apicus, dc=ch objectclass: organizationalUnit ou: addresses description: Apicus Addressbook dn: cn=Laurent Bourqui, ou=addresses, dc=apicus, dc=ch objectClass: top objectClass: inetOrgPerson uid: 00001 cn: Laurent Bourqui gn: Laurent sn: Bourqui mobile: +xxxxxxxxx homePhone: +xxxxxxxxxxx street: xxxxxxxxxxxx postalCode: xxxxx l: xxxxxxxxxx st: xxx ---------------------------------------- The ldif file has been imported with the following command: ldapadd -x -W -D 'cn=admin,dc=apicus,dc=ch' -f apicus-addresses.ldiff I'm now trying to delete the entry: dn: cn=Laurent Bourqui, ou=addresses, dc=apicus, dc=ch using the following command: ldapdelete -x -W -D 'cn=admin,dc=apicus,dc=ch' "cn=Laurent Bourqui, ou=addresses, dc=apicus, dc=ch" This command hangs and continuisly bring the error message in the logs. I have search the FAQ, google and event the berkley DB infos for informations but I was not able to find any hint about the reason of this problem. Did anybody already encoutered this error ? Versions: openldap 2.4.10 FreeBSD 7.0 Any feedback will be welcom. Many thanks in advance for your help. Best Regards -- Laurent Bourqui

1 0

problem connection in local with account root
by GanGan 17 Jul '08

17 Jul '08

hello all I have problem for connect in local in my server rhel 5.1with the root account all the connection with ssh are good, root too I use ldap for other account the root account is not in ldap my /etc/nsswitch.conf passwd: files [SUCCESS=return] ldap shadow: files [SUCCESS=return] ldap group: files [SUCCESS=return] ldap when I delete ldap in my nsswitch.conf the connection local with the root account works well I have modified /etc/pam.d/sshd no other files in /etc/pam.d/ my /etc/pam.d/sshd auth optional pam_group.so auth required pam_env.so auth sufficient pam_unix.so likeauth auth sufficient pam_ldap.so use_first_pass auth required pam_deny.so auth required pam_warn.so account sufficient pam_unix.so account sufficient pam_ldap.so ignore_unknown_user account required pam_deny.so account required pam_warn.so password required pam_cracklib.so retry=2 minlen=8 password sufficient pam_unix.so use_authok md5 shadow password sufficient pam_ldap.so use_authok password required pam_deny.so password required pam_warn.so session optional pam_mkhomedir.so skel=/etc/skel/ umask=077 silent session required pam_limits.so session optional pam_ldap.so ignore_unknown_user session required pam_warn.so someone could help me - GanGan -

1 0

forcing group membership removal
by daniel rahmeh 17 Jul '08

17 Jul '08

Hi, I have another question concerning group membership. Is there a way to force openldap to remove the user DN from a group when i delete the user entry from openLDAP? In other words, is there some kind of configuration that tells openLDAP to remove the user DN from the member attribute of a group once the user entry is deleted from the directory. Thank you

2 2

openldap entry modification
by daniel rahmeh 17 Jul '08

17 Jul '08

hi, I have a question concerning the best method to modify an entry (in openldap) using a programming API like php. php offers the ability to modify an entry using some fucntions like ldap_modify, ldap_mod_add, ldap_mod_del. sometimes it's complicated to use these functions, in this case, developpers use another approach, which is deleting the entry and then add it with the new attributes etc. my question is: is it fine to delete an entry and re-add it?? does this affect the performance of openLDAP? thank you

2 3

starting slapd 2.4.10
by Christophe Thibault 17 Jul '08

17 Jul '08

Hi, I'm currently playing with Samba 4 alpha and OpenLdap 2.4.10. I want to start slapd with this command line (i'm currently logged in as root) : slapd -d 16384 -f /usr/local/samba/private/ldap/slapd.conf -h ldapi://%2Fusr%2Flocal%2Fsamba%2Fprivate%2Fldap%2Fldapi But I get the following error trace: @(#) $OpenLDAP: slapd 2.4.10 (Jul 11 2008 09:22:55) $ buildd@vernadsky:/build/buildd/openldap-2.4.10/debian/build/servers/slapd daemon: bind(7) failed errno=13 (Permission denied) slapd stopped. connections_destroy: nothing to destroy. I tried to replace the ldapi uri by "ldap:///", but now I'm getting a could not open config file "/usr/local/samba/private/ldap/slapd.conf": Permission denied (13) error message, while all rights and group/owner seem to be OK (ls -l returns -rw-r--r--). I think I miss something, but i'm stuck for now, if someone has any idea... thanks, chris

2 1

Trouble with nisnetgrouptriple syntax / RFC 2307
by Jeff Blaine 17 Jul '08

17 Jul '08

I've come across the same problem as the original poster found here: http://www.openldap.org/lists/openldap-technical/200804/msg00127.html The only reply to him indicated that his syntax was incorrect for nisnetgrouptriple according to RFC 2307. I cannot see how it is invalid based on the syntax definition from RFC 2307. My example: > dn: cn=users1,ou=Netgroup,dc=rcf,dc=foo,dc=com > objectClass: nisNetgroup > objectClass: top > cn: users1 > nisNetgroupTriple: (-,asgen2m,) > nisNetgroupTriple: (-,apdons,) > nisNetgroupTriple: (-,ffeins,) > nisNetgroupTriple: (-,faullton,) The syntax definition: > nisnetgrouptriple = "(" hostname "," username "," domainname ")" > hostname = "" / "-" / keystring > username = "" / "-" / keystring > domainname = "" / "-" / keystring Does that not state that hostname, username, domainname can each be ANY of: empty - keystring ?? Any guidance would be welcome! Jeff Blaine

4 6

script for adding users information in ldap database
by Aravind Arjunan 17 Jul '08

17 Jul '08

hi, i had configured openldap in RHEL 5. It was in master/slave replication in syncrepl method (refreshOnly) method. I had to add users information in the ldap database. Nearly 15000 users are there so i can able to add all the 15000 users infromation at a time. so i need a script or some utility to add all the user infromation at the same time. Am using LDAP Browser for adding the entries now. so plz help me how to add all the users information at single time.

6 6

N-way multimaster
by Miguel Jinez 16 Jul '08

16 Jul '08

Hi. I need help to fix a problem. I am running openLdap 2.4 I have configurated 2 multimaster servers, which works fine, but I was thinking what happen if one of them die? When that master is restarted read the "logold" parameter in the other master and synchronize the changes, problem solved. But what happen if one master dies, meanwhile the other master performs changes in the Ldap tree (add, modify, delete) and that master dies too? I have test it and the changes that I made in the second master are not synchronized on the first one, and I don t know how I can synchronize the changes, I have accesslog configurated, I can see in the second one log these changes but the first one doesn t read it when is restarted. I need your help. sorry by the bad english. Migue

2 4

slapd was refusing connections from local clients
by Haim [Howard] Roman 15 Jul '08

15 Jul '08

I had a strange situation where the slapd would accept connections from other machines, but not from the local host. It didn't matter whether the local client program was the RADIUS server or ldapsearch. According to netstat & lsof, slapd was listening on all interfaces. Setup: * CentOS release 4.6 * slapd 2.2.13 (Jul 11 2008 09:16:05) (CentOS package) * This slapd maintains a replica data base. (The slapd on the master server is slapd 2.3.35, Jun 11 2007, running on Solaris 10.) * FreeRADIUS Version 1.0.1, built on May 10 2007 -- it uses the local slapd to get user names & passwords. Yesterday we had a power outage, and the UPS didn't work :-( Someone suggested that maybe things came up in the wrong order & that a reboot would help. And the reboot did indeed solve the problem. But I'd still like to know what happened. Before the reboot, I even tried turning on the following log levels (in /etc/slapd.conf): loglevel conns config stats sync packets BER ACL none But I really couldn't find any messages that helped me understand *why* I had this strange problem. Any suggestions, or even pointers on how to find out? Thanks. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Haim (Howard) Roman Computer Center, Jerusalem College of Technology roman(a)jct.ac.il Phone: 052-8-592-599 (6022 from within Machon Lev)

1 0

Convert Fedora-DS LDIF to OpenLDAP?
by John Oliver 15 Jul '08

15 Jul '08

Google hasn't helped... I only found something to go the other way. And I didn't see this addressed in the FAQ, either. -- *********************************************************************** * John Oliver http://www.john-oliver.net/ * * * ***********************************************************************

5 5

Changing password from squirrelmail
by Aravind Arjunan 12 Jul '08

12 Jul '08

hi, I had configured openldap 2.3 in RHEL 5 operating system, and my squirrel mail is running in RHEL 4. I had integrated these two for address book synchronization. Its working fine .In my squirrelmail options i had change password option. I can able to chang the password by giving the old password and typing new password. SO that it will automatically changed in openldap database also for a particular user. But when am trying to change the password am getting error, *"Your login account was not found in the LDAP database, cannot change password!"*

1 0

Newbie OpenLDAP woes
by Kristen Walker 11 Jul '08

11 Jul '08

Hi everyone, I am new to OpenLDAP and this list. I joined because I am trying to set up an OpenLDAP server so that Moodle and ELGG can authenticate users from the LDAP server. It is a little more difficult than I thought it would be, and I am running into some frustrating problems that I don't understand. I am hoping someone here might be able to help. I am using Ubuntu and using the book Mastering OpenLDAP as my guide. I have the server set up, edited config files and installed phpldapadmin to make things a little easier for me. I added my first entries but do not see them when I do a search, and nothing appears under my base in phpldapadmin (see attached screen shot). I don't get any complaints when I add the entries from my .ldif file, so I just don't understand why they don't seem to end up in my directory. If I do this command, sudo slapcat -a '(uid=barbara)' , the result is: dn: ou: Users uid: barbara sn: Jensen cn: Barbara Jensen givenName: Barbara displayName: Barbara Jensen mail: barbara(a)example.com userPassword:: c2VjcmV0 objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson structuralObjectClass: inetOrgPerson entryUUID: 8565f97e-e25b-102c-828c-238ab0ab2691 creatorsName: cn=Manager,dc=example,dc=com modifiersName: cn=Manager,dc=example,dc=com createTimestamp: 20080709233555Z modifyTimestamp: 20080709233555Z entryCSN: 20080709233555Z#000005#00#000000 So, it seems like there is a user with uid barbara in the directory. But if I try using ldapsearch to find that user, and I use this command, ldapsearch -x -D 'cn=Manager,dc=example,dc=com' -b 'ou=Users,dc=example,dc=com' -LLL '(userID=barbara)' + I get this: No such object (32) Also, it seems like I can't connect to my database unless I do an anonymous bind. When I try typing in a password to login to phpldapadmin it rejects my credentials and the same thing when I try using -w with a password on the command line. Thanks so much for any and all help in advance! -Kristen -- Kristen Walker Digital Media Resources Developer Instructional Media Services Santa Barbara County Education Office 4400 Cathedral Oaks Road P.O. Box 6307 Santa Barbara, CA 93160-6307 (805)964-4711 ext. 5244/FAX (805)683-3597 kwalker(a)sbceo.org http://www.sbceoportal.org

5 8

Problems using OpenLPAP for authentification of users: Client library issues STARTTLS but TLS is not configured
by Jörg Spilker 10 Jul '08

10 Jul '08

Hi, well, i don´t know what i´m doing wrong. I just want to authenticate unix and windows users against OpenLDAP Database. I followed some howtos to setup openldap, winbind etc. and nearly everything seems just fine. But authenticating unix users finally doesn´t work. I´ve attached the syslog output. START TLS extension not supportet. This is true, as i haven´t configured OpenLPAP for TLS. But my LDAP client configuration doesn´t specify an LDAPS URL. So what´s going wrong? Greeting, Jörg # # This is the configuration file for the LDAP nameservice # switch library, the LDAP PAM module and the shadow package. # # Your LDAP server. Must be resolvable without using LDAP. URI ldap://localhost # The distinguished name of the search base. base dc=jetsys,dc=de # The LDAP version to use (defaults to 3 # if supported by client library) ldap_version 3 # Don't try forever if the LDAP server is not reacheable bind_policy soft # The distinguished name to bind to the server with. # Optional: default is to bind anonymously. binddn cn=Manager,dc=jetsys,dc=de # The credentials to bind with. # Optional: default is no credential. bindpw XXXXXXXXX # The distinguished name to bind to the server with # if the effective user ID is root. Password is # stored in /etc/ldap.secret (mode 600) rootbinddn cn=Manager,dc=jetsys,dc=de Jul 9 07:32:26 xdaolin slapd[2241]: conn=702 fd=23 ACCEPT from IP=127.0.0.1:15332 (IP=0.0.0.0:389) Jul 9 07:32:26 xdaolin slapd[2241]: conn=702 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jul 9 07:32:26 xdaolin slapd[2241]: conn=702 op=0 do_extended: unsupported operation "1.3.6.1.4.1.1466.20037" Jul 9 07:32:26 xdaolin slapd[2241]: conn=702 op=0 RESULT tag=120 err=2 text=unsupported extended operation Jul 9 07:32:26 xdaolin slapd[2241]: conn=702 op=1 UNBIND Jul 9 07:32:26 xdaolin slapd[2241]: conn=702 fd=23 closed Jul 9 07:32:26 xdaolin slapd[2241]: conn=703 fd=23 ACCEPT from IP=127.0.0.1:15333 (IP=0.0.0.0:389) Jul 9 07:32:26 xdaolin slapd[2241]: conn=703 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jul 9 07:32:26 xdaolin slapd[2241]: conn=703 op=0 do_extended: unsupported operation "1.3.6.1.4.1.1466.20037" Jul 9 07:32:26 xdaolin slapd[2241]: conn=703 op=0 RESULT tag=120 err=2 text=unsupported extended operation Jul 9 07:32:26 xdaolin slapd[2241]: conn=703 op=1 UNBIND Jul 9 07:32:27 xdaolin slapd[2241]: conn=703 fd=23 closed Jul 9 07:32:27 xdaolin getent: nss_ldap: could not search LDAP server - Server is unavailable

3 3

LDAP binding failure to Active Directory using certificates
by Clayton Tucker 10 Jul '08

10 Jul '08

Greetings: I'm wondering if anyone has had any experience with this problem. I am endevouring to use ldapmodify (from OpenLDAP 2.3) to connect to a domain controller (named intacta) in our Active Directory forest and perform account management operations. For this purpose, the bind to the AD's LDAP must provide credentials of a user with the rights to manage accounts in the domain in question. I'm attempting to perform the authentication using certificates generated by a certificate authority which we have established on a domain controller in the forest root domain of our AD (not the same domain as the domain where we are trying to perform account management but is the same forest). The bind account is named test_account_manager and the user certificate CSCFForestAccount.cer (listed below) is name mapped to the account. All domain controllers in the forest have domain controller certificates distributed to them from the forest's certificate authority. Below is the content of my .ldaprc file on the Solaris 8 host where I'm attempting to run ldapmodify. As stated above, the TLS_CERT certificate is name mapped to the test_account_manager account in the AD. The account of coarse, has a password but the key file has no access password as I believe is necessary for the current version of openldap. TLS_CACERT /u/ctucker/LDAP_Cert/CSCFTrustedCA.pem.cer TLS_CERT /u/ctucker/LDAP_Cert/CSCFForestAccount.cer TLS_KEY /u/ctucker/LDAP_Cert/private_test1.pem TLS_REQCERT demand Below is the output of an ldapmodify command run on the Solaris 8 host. When this command is run entries confirming the logon of the test_account_manager account appear in the security event logs of the domain controller intacta as a successful logon. This suggests that the connection was properly authenticated by the certificates for the user test_account_manager. However, the subsequent binding to LDAP fails with the error "Authentication method not supported" Any help with this persistent problem would be greatly appriciated. Thanks. Clayton % ldapmodify -d13 -H ldaps://intacta.cs.uwaterloo.ca/ ldap_create ldap_url_parse_ext(ldaps://intacta.cs.uwaterloo.ca/) ldap_pvt_sasl_getmech ldap_search put_filter: "(objectclass=*)" put_filter: simple put_simple_filter: "objectclass=*" ldap_build_search_req ATTRS: supportedSASLMechanisms ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP intacta.cs.uwaterloo.ca:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 129.97.152.158:636 ldap_connect_timeout: fd: 3 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 1, err: 0, subject: /DC=ca/DC=uwaterloo/DC=cscf/CN=CSCF Forest CA, issuer: /DC=ca/DC=uwaterloo/DC=cscf/CN=CSCF Forest CA TLS certificate verification: depth: 0, err: 0, subject: /CN=intacta.cs.uwaterloo.ca, issuer: /DC=ca/DC=uwaterloo/DC=cscf/CN=CSCF Forest CA TLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write certificate verify A TLS trace: SSL_connect:SSLv3 write change cipher spec A TLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL_connect:SSLv3 read finished A ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush: 64 bytes to sd 3 ldap_result ld 30748 msgid 1 ldap_chkResponseList ld 30748 msgid 1 all 1 ldap_chkResponseList returns ld 30748 NULL wait4msg ld 30748 msgid 1 (infinite timeout) wait4msg continue ld 30748 msgid 1 all 1 ** ld 30748 Connections: * host: intacta.cs.uwaterloo.ca port: 636 (default) refcnt: 2 status: Connected last used: Thu Jul 10 09:50:43 2008 ** ld 30748 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** ld 30748 Response Queue: Empty ldap_chkResponseList ld 30748 msgid 1 all 1 ldap_chkResponseList returns ld 30748 NULL ldap_int_select read1msg: ld 30748 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 96 contents: read1msg: ld 30748 msgid 1 message type search-entry ber_get_next ber_get_next: tag 0x30 len 16 contents: read1msg: ld 30748 msgid 1 message type search-result ber_scanf fmt ({eaa) ber: read1msg: ld 30748 0 new referrals read1msg: mark request completed, ld 30748 msgid 1 request done: ld 30748 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 adding response ld 30748 msgid 1 type 101: ldap_parse_result ber_scanf fmt ({iaa) ber: ber_scanf fmt (}) ber: ldap_get_values ber_scanf fmt ({x{{a) ber: ber_scanf fmt ([v]) ber: ldap_msgfree ldap_sasl_interactive_bind_s: server supports: GSSAPI GSS-SPNEGO EXTERNAL DIGEST-MD5 ldap_int_sasl_bind: GSSAPI GSS-SPNEGO EXTERNAL DIGEST-MD5 ldap_int_sasl_open: host=intacta.cs.uwaterloo.ca => ldap_dn2bv(16) <= ldap_dn2bv(CN=test_account_manager,OU=Test User,OU=Unassigned,DC=cs,DC=uwaterloo,DC=ca)=0 SASL/EXTERNAL authentication started ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({i) ber: ber_flush: 26 bytes to sd 3 ldap_result ld 30748 msgid 2 ldap_chkResponseList ld 30748 msgid 2 all 1 ldap_chkResponseList returns ld 30748 NULL wait4msg ld 30748 msgid 2 (infinite timeout) wait4msg continue ld 30748 msgid 2 all 1 ** ld 30748 Connections: * host: intacta.cs.uwaterloo.ca port: 636 (default) refcnt: 2 status: Connected last used: Thu Jul 10 09:50:43 2008 ** ld 30748 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ** ld 30748 Response Queue: Empty ldap_chkResponseList ld 30748 msgid 2 all 1 ldap_chkResponseList returns ld 30748 NULL ldap_int_select read1msg: ld 30748 msgid 2 all 1 ber_get_next ber_get_next: tag 0x30 len 103 contents: read1msg: ld 30748 msgid 2 message type bind ber_scanf fmt ({eaa) ber: read1msg: ld 30748 0 new referrals read1msg: mark request completed, ld 30748 msgid 2 request done: ld 30748 msgid 2 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 2, msgid 2) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_sasl_bind_result ber_scanf fmt ({eaa) ber: ldap_msgfree ldap_perror ldap_sasl_interactive_bind_s: Authentication method not supported (7) additional info: 00002027: LdapErr: DSID-0C090499, comment: Invalid Authentication method, data 0, vece

1 1

problem with openldap ssl client
by Sambuddho Chakravarty 10 Jul '08

10 Jul '08

Hello I have an openldap server running slapd on 636 (LDAPS) . When I connect from a ldap browser , I am able to successfully browse the database. However when I try to connect from a linux client machine (Ubuntu Server 8.04) I am not able to connect to the ldaps. However regular ldap works fine. The /etc/ldap.conf looks like this ssl start_tls ssl on tls_checkpeer tes tls_cacertdir /etc/ldap/cacerts tls_cacertfile /etc/ldap/cacert/cacert.pem #server IP uri ldaps://30.0.0.2/ pam_password md5 base dc=example,dc=com The /etc/ldap/ldap.conf file is like this URI ldaps://30.0.0.2/ TLS_CACERTDIR /etc/ldap/cacerts TLS_CACERT /etc/ldap/cacerts/cacert.pem HOST 30.0.0.2 BASE dc=example,dc=com The same configuration (with approprirate changes - replacing ldaps with ldap and so on) works fine for regular ldap. But the problem is the ldaps. When ldaps client is enabled and I do a getent passed , the /var/log/auth.log looks like this Jul 7 23:57:46 host3 getent: nss_ldap: reconnecting to LDAP server... Jul 7 23:57:46 host3 getent: nss_ldap: reconnecting to LDAP server (sleeping 1 seconds)... Jul 7 23:57:47 host3 getent: nss_ldap: could not search LDAP server - Server is unavailable Jul 7 23:58:18 host3 getent: nss_ldap: reconnecting to LDAP server... Please suggest where I could have gone wrong. Any suggestions would be really appreciated. Thanks Sambuddho

5 8

Re: problem with openldap ssl client
by Pat Riehecky 09 Jul '08

09 Jul '08

On Tue, 2008-07-08 at 16:45 -0400, Sambuddho Chakravarty wrote: > Hello Pat > I think I am . I did apt-get update and tried a apt-get install > libnss-ldap and it said you already have the latest packages. > Ok, one more thing to check what does the output of apt-get -f dist-upgrade report? Pat > Thanks > Sambuddho > On Tue, 2008-07-08 at 15:39 -0500, Pat Riehecky wrote: > > On Tue, 2008-07-08 at 00:06 -0400, Sambuddho Chakravarty wrote: > > > Hello > > > I have an openldap server running slapd on 636 (LDAPS) . When I connect > > > from a ldap browser , I am able to successfully browse the database. > > > However when I try to connect from a linux client machine (Ubuntu Server > > > 8.04) I am not able to connect to the ldaps. However regular ldap works > > > fine. > > > > There was a problem with the original 8.04 ldap packages (I think it was > > actually gnutls related but memory fails). Are you on the latest and > > greatest packages? > > > > Pat > > > >

2 2

Importing data from SunLDAP to OpenLDAP
by Jayesh Kamdar 09 Jul '08

09 Jul '08

I just set up OpenLDAP instance and would like to export data from my SunLDAP and import into my OpenLDAP instance. How do I go about it? My main concern is, how do I make sure that the exported files' field will match and import properly in my OpenLDAP database. Please let me know, if any of you have gone through migration from SunLDAP to OpenLDAP and have any pointers for me. Thanks. Jayesh Kamdar jkamdar(a)yahoo.com

3 2

Setting up "slave" OpenLDAP server
by John Oliver 09 Jul '08

09 Jul '08

I know nothing about LDAP / OpenLDAP. With that out of the way... I have a CentOS 5 machine running openldap-2.3.27-8 I just built a CentOS 5.2 machine with openldap-2.3.27-8.el5_1.3 My goal is to have the LDAP on the first machine synch with, and stay synched to, the LDAP on the second machine, so if the first machine dies I can bring up an interface with it's IP on the second and get authentication working again. I've Googled "LDAP replication" and "LDAP synchronization". Both terms lead me to a variety of papers that have a variety of ideas of how this should be done, and some have diagrams of convoluted networks involving multiple load balancers, etc. Since I know nothing about LDAP or OpenLDAP, it is very difficult for me to evaluate what I'm seeing... is this way "best", but because it's part of a globe-spanning install with hundreds of thousands of users? I'm hoping for a pointer to a nice, simple document that doesn't pre-suppose any depth of knowledge and isn't part of a Holy War over which method of doing this confers the greatest bragging rights :-) -- *********************************************************************** * John Oliver http://www.john-oliver.net/ * * * ***********************************************************************

3 2

ldap changes
by Daniel Lamb 09 Jul '08

09 Jul '08

Hi I was wondering if there is a simple way to clear out the data within ldap, the first time I do an install it asked for a password but even if I try and reconfigure it, it does not ask for the password again, I have installed it using "apt-get install slapd ldap-utils migrationtools" on Ubuntu 8.04, the reason I would like to clear it out is so I can make a distro which has the software installed and only needs the config files changed. Cheers, Daniel

2 1

nss_ldap error
by GanGan 08 Jul '08

08 Jul '08

hello all, I have a ldap server and tls (all command on local in the server ldap) [root@srvtest3 /]# ldapsearch -x -H ldap://srvtest3.test.org -ZZ '*' # extended LDIF # # LDAPv3 # base with scope subtree # filter: (objectclass=*) # requesting: * # # midian.org dn: dc=midian,dc=org objectClass: top objectClass: dcObject objectClass: organization o: Midian dc: midian [...] # search result search: 3 result: 0 Success # numResponses: 13 # numEntries: 12 tls is ok ? non ? ps -ef | grep slapd : root 32279 1 0 00:42 ? 00:00:02 /usr/sbin/slapd -4 in my log sshd : July 08 10:13:11 srvtest3 sshd[1482]: nss_ldap: could not search LDAP server - Server is unavailable I do not see what side look -- gangan

1 0

Real idletimeout more than configured idletimeout
by Eric Déchaux 07 Jul '08

07 Jul '08

Dear openldap gurus, I am hitting some strange behavior with the idle sessions timeout feature. In my configuration this timeout is set to 60 seconds on 4 slaves that are behind a load balancer. This load balancer times-out idle sessions after 90 seconds, which should be fine. Openldap version is the stable one from Debian Etch r3. I however encounter random connection issues that have been traced to the load balancer timeouting and idle session *before* the ldap slave. I have straced the slapd process and I found out the applyed idletimeout was way above the configured one, please check the two following strace output : Output 1 futex(0x603428, FUTEX_WAKE, 1) = 1 select(16, [4 6 7], NULL, NULL, {300, 0}) = 1 (in [6], left {238, 132000}) accept(6, {sa_family=AF_INET, sin_port=htons(34103), sin_addr=inet_addr("192.168.1.1")}, [4647729933731233808]) = 12 setsockopt(12, SOL_SOCKET, SO_KEEPALIVE, [1], 4) = 0 setsockopt(12, SOL_TCP, TCP_NODELAY, [1], 4) = 0 open("/etc/hosts.allow", O_RDONLY) = 15 fstat(15, {st_mode=S_IFREG|0644, st_size=677, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2aaaaccb3000 read(15, "# /etc/hosts.allow: list of host"..., 4096) = 677 read(15, "", 4096) = 0 close(15) = 0 munmap(0x2aaaaccb3000, 4096) = 0 open("/etc/hosts.deny", O_RDONLY) = 15 fstat(15, {st_mode=S_IFREG|0644, st_size=901, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2aaaaccb3000 read(15, "# /etc/hosts.deny: list of hosts"..., 4096) = 901 read(15, "", 4096) = 0 close(15) = 0 munmap(0x2aaaaccb3000, 4096) = 0 fcntl(12, F_GETFL) = 0x2 (flags O_RDWR) fcntl(12, F_SETFL, O_RDWR|O_NONBLOCK) = 0 stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0 stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0 stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0 sendto(3, "<167>Jul 1 09:14:14 slapd[2765]"..., 102, MSG_NOSIGNAL, NULL, 0) = 102 select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 1 (in [12], left {15, 0}) read(12, "0b\2\1\1`]\2", 8) = 8 [ some uninteresting ldap stuff ] futex(0x603428, FUTEX_WAKE, 1) = 1 read(12, 0x6f30ff, 8) = -1 EAGAIN (Resource temporarily unavailable) futex(0x2b0db3b35dc8, FUTEX_WAKE, 1) = 1 select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 0 (Timeout) select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 0 (Timeout) select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 0 (Timeout) select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 0 (Timeout) select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 0 (Timeout) write(5, "0", 1) = 1 shutdown(12, 2 /* send and receive */) = 0 close(12) = 0 Here, we can see 5 select system calls for a real idletimeout is 75 seconds instead of 60. Output 2 futex(0x603428, FUTEX_WAKE, 1) = 1 select(16, [4 6 7], NULL, NULL, {300, 0}) = 1 (in [6], left {230, 828000}) accept(6, {sa_family=AF_INET, sin_port=htons(51692), sin_addr=inet_addr("192.168.1.1")}, [4647729933731233808]) = 12 setsockopt(12, SOL_SOCKET, SO_KEEPALIVE, [1], 4) = 0 setsockopt(12, SOL_TCP, TCP_NODELAY, [1], 4) = 0 open("/etc/hosts.allow", O_RDONLY) = 15 fstat(15, {st_mode=S_IFREG|0644, st_size=677, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2aaaaccb3000 read(15, "# /etc/hosts.allow: list of host"..., 4096) = 677 read(15, "", 4096) = 0 close(15) = 0 munmap(0x2aaaaccb3000, 4096) = 0 open("/etc/hosts.deny", O_RDONLY) = 15 fstat(15, {st_mode=S_IFREG|0644, st_size=901, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2aaaaccb3000 read(15, "# /etc/hosts.deny: list of hosts"..., 4096) = 901 read(15, "", 4096) = 0 close(15) = 0 munmap(0x2aaaaccb3000, 4096) = 0 fcntl(12, F_GETFL) = 0x2 (flags O_RDWR) fcntl(12, F_SETFL, O_RDWR|O_NONBLOCK) = 0 stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0 stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0 stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2945, ...}) = 0 sendto(3, "<167>Jul 1 09:19:21 slapd[2765]"..., 102, MSG_NOSIGNAL, NULL, 0) = 102 select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 1 (in [12], left {15, 0}) read(12, "0b\2\1\1`]\2", 8) = 8 [ some uninteresting ldap stuff ] futex(0x2b0db3b35dc8, FUTEX_WAKE, 1) = 1 select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 0 (Timeout) select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 0 (Timeout) select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 0 (Timeout) select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 0 (Timeout) select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 0 (Timeout) select(16, [4 6 7 12], NULL, NULL, {15, 0}) = 0 (Timeout) write(5, "0", 1) = 1 shutdown(12, 2 /* send and receive */) = 0 close(12) = 0 Here, we can see 5 select system call for a real idletimeout is 75 Here we have 6 select system calls for a real idletimeout of 90 seconds which is enough for the session to expire on the load balancer. I have checked the source code and the logic that choose either to idletimeout the session or go into a "SLAP_EVENT_WAIT" (select) call is the following : from server/slap/daemon.c now = slap_get_time(); if ( ( global_idletimeout > 0 ) && difftime( last_idle_check + global_idletimeout/SLAPD_IDLE_CHECK_LIMIT, now ) < 0 ) { connections_timeout_idle( now ); last_idle_check = now; } As I understand this, no connection should be tested against the idletimeout before any "event wait loop" takes more time than the idletimeout parameter / 4. In my case, I need the "event wait loop" to last more than 15 seconds for connections to be checked against aging. If I am not mistaken, as the difftime call compares seconds, I need the loop to last a least for 16 seconds for the connections_timeout_idle procedure to be called. Am I understanding everything the right way ? If it is the case, shouldn't the difftime call be tested <= 0 to help idle sessions to be cleaned sonner ? Many thanks. -- Eric Déchaux Ingénieur Kébabiste Sun Microsystems Services France

2 3

Identifying replicas behind a load balancer
by Sean Burford 06 Jul '08

06 Jul '08

Hi, To help with troubleshooting I would like to identify my replicas through an ldap search, even when they are behind a load balancer. I was wondering what method and attribute other people generally use for this purpose. The RootDSE may be unique for each host, I can add a RootDSE config line to slapd.conf to insert an ldif into the root DSE, so it seems to be the ideal spot for per server identification. Other spots include cn=monitor, cn=config, cn=Subschema or the main directory tree. The monitorConnectionPeerAddress attribute in cn=monitor isn't useable for identifying the server, since the address appears as IP=0.0.0.0:389. cn=config isn't generally accessible so also isn't suitable. The subschema could conceivably be twisted for this purpose. The main directory tree is replicated so is not suitable for identifying unique servers. The RootDSE schema specifies that it may have a cn. OpenLDAP does not provide one by default. Is it safe to use cn=hostname.domain.name? It seems easiest to use CN for the host name, if it isn't earmarked for something else in the RootDN. The alternative would be to supplement the rootDSE with one or more new attributes. I've had a look at how Active Directory and Novell Directory Service identify servers. They both use attributes with similar names and definitions. Active Directory has three attributes that are used in the root DSE to identify the host. Novell Directory Service has the same three attributes with very similar names and equivalent descriptions/usage. The attributes are: * dnsHostName: The DNS name of this DC. * serverName: DN for the server object for this directory server as defined in the Configuration container. * ldapServiceName: The UPN (User Principal Name) of the domain controller hosting this instance of RootDSE. Computer objects are just special forms of User objects, so they can have UPNs. The dollar sign is Microsoft shorthand dating back to classic NT and SAM. It indicates a hidden or secret object. eg: $ ldapsearch -x -W -D unix.gurus(a)example.com -H ldaps://dc.example.com -b "" -s base serverName dnsHostName ldapServiceName dnsHostName: dc.example.com serverName: CN=DC,CN=Servers,CN=Configuration,DC=example,DC=com ldapServiceName: example.com:dc$@EXAMPLE.COM The schema for these attributes is described in various places. The existing schema is somewhat unsatisfactory with the dnsHostName OID (1.2.840.113556.1.4.619) being a duplicate of the lazy commit control OID and serverName syntax being a Directory String rather than a Distinguished Name. For my testing I've defined the following non standard attributes. There doesn't seem to be a need for an equality matching rule since these are single valued rootDSE attributes: # Non standard AD dNSHostName attribute (defines a max length in the syntax) attributetype ( 1.2.840.113556.1.4.619 NAME 'dNSHostName' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15{256}' DESC 'DNS name of the directory server hosting this RootDSE.' SINGLE-VALUE ) # Non standard AD serverName attribute (DN syntax instead of Directory String) attributetype ( 1.2.840.113556.1.4.223 NAME 'serverName' SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' DESC 'DN for the server object for this directory server.' SINGLE-VALUE ) -- Thanks, Sean Burford

2 1

Trouble setting password
by Fred Zinsli 05 Jul '08

05 Jul '08

Hello everyone Newby here. I am having trouble getting started with my new ldap install. I got it installed on FC8 and am now attempting to configure it. I am attempting to setup the default password and I am getting this message. [root@dofiss ~]# ldappasswd SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database This is my second day on trying to sort this out so any comments would be most helpful. Regards Fred

2 2

[ldap with tls] installation problem
by GanGan 04 Jul '08

04 Jul '08

Hello all, I try to install tls for ldap but without success :( I make a CA (compiled openssl) when i start ldap with : service ldap start i have this logs : May 27 20:39:29 srvtest3 slapd[19546]: @(#) $OpenLDAP: slapd 2.3.27 (Jun 27 2007 08:48:26) $ brewbuilder@ls20-bc1-13.build.redhat.com:/builddir/build/BUIL D/openldap-2.3.27/openldap-2.3.27/build-servers/servers/slapd May 27 20:39:29 srvtest3 slapd[19546]: nss_ldap: could not search LDAP server - Server is unavailable May 27 20:39:29 srvtest3 slapd[19546]: nss_ldap: could not search LDAP server - Server is unavailable May 27 20:39:29 srvtest3 slapd[19546]: /etc/openldap/slapd.conf: line 39: rootdn is always granted unlimited privileges. May 27 20:39:29 srvtest3 slapd[19546]: /etc/openldap/slapd.conf: line 44: rootdn is always granted unlimited privileges. May 27 20:39:29 srvtest3 slapd[19546]: main: TLS init def ctx failed: -1 May 27 20:39:29 srvtest3 slapd[19546]: slapd stopped. May 27 20:39:29 srvtest3 slapd[19546]: connections_destroy: nothing to destroy. my /etc/openldap/slapd.conf is : include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema # logs loglevel 4 # needed for login_ldap allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args database bdb suffix "dc=midian,dc=org" rootdn "cn=god,dc=midian,dc=org" rootpw {SSHA}EkM4ViGxzWnZQ2n5hKBBcfffFMTcCO-0E4 directory /var/lib/ldap index objectClass eq # ACL access to attrs=userPassword by self write by anonymous auth by dn="cn=god,dc=midian,dc=org" write by * none access to * by self write by dn="cn=god,dc=midian,dc=org" write by * read # CA signed certificate and server cert entries: # TLS & SSL TLSCertificateFile /etc/openldap/cacerts/srvtest3.test.org.pem TLSCertificateKeyFile /etc/openldap/cacerts/srvtest3.test.org.key TLSCACertificateFile /etc/ssl/cacert.pem TLSVerifyClient never my /etc/openldap/ldap.conf base dc=midian,dc=org uri ldap//srvtest3.test.org/ ldap_version 3 TLS_CACERT /etc/ssl/cacert.pem TLS_REQCERT demand my /etc/ldap.conf # SSL & TLS ssl start_tls #ssl on #tls_checkpeer yes # Afin que le client puisse valider l'identitéu serveur, on doit le fournir la cléublique # du CA avec laquelle il pourra éblir que le certificat du serveur a bien é signéar # la clérivéde cette mê CA. TLS_CACERT /etc/openldap/cacerts/ldap.crt # On demande élement au client de toujours valider l'identitéu serveur. TLS_REQCERT demand # IP du serveur ldap #host 127.0.0.1 uri ldap://srvtest3.test.org/ # Le DN de base pour effectuer les recherches base dc=midian,dc=org # Optimisation de recherche dans la base scope=one # Pour que le poste demarre meme si le server ldap ne repond pas bind_policy soft # Version du protocole utilise ldap_version 3 # Port ecoute serveur port 389 # Filtres de validation dun utilisateur pam_filter objectclass=account pam_filter host=srvtest3.test.org # Attribut compare avec lindentifiant de connexion de lutilisateur pam_login_attribute uid # Verification attribut host pam_check_host_attr yes # DN groupe auquel il faut appartenir pour acces machine locale pam_groupdn ou=group,dc=midian,dc=org # Definit lattribut dappartenance au groupe pam_member_attribute member # password envoi serveur pam_password crypt # Parametres nss-ldap de recherche nss_base_passwd ou=user,dc=midian,dc=org?sub nss_base_shadow ou=user,dc=midian,dc=org?sub nss_base_group ou=group,dc=midian,dc=org?sub nss_base_hosts ou=machines,dc=midian,dc=org?sub if someone could help me it would be nice sorry for my bad english - GanGan -

2 1

Performance - keep connection open between operations?
by k bah 04 Jul '08

04 Jul '08

I have some code that connects do LDAP, and between LDAP operations for a connection made, I have to contact other server (not LDAP), I wanna know if closing the connection to LDAP and then making it again (and of course a new bind) will take more time (I guess so) than wait for the "other" server to respond, and keep the connection to LDAP open. On some tests, the whole code (connect to the other server, closing that connection, and after that connecting to LDAP), with similar operations (operations performed on the "other" server and on the LDAP server) take no more than 1 second. The test was made with a *test* LDAP server, serves just me, but the "other" server, is a production one, that "almost 1 second group of operations" was made on a test LDAP server, and a real "other" server(busy), our company has a huge network and that server is clustered, thousands of connections/minute. I think it's best to connect to LDAP, bind, make operations on LDAP server, keep the connection open, query the "other" server, then get back with the LDAP operations, and just then close the connection to the LDAP server, what do you think? thanks = Home Business Miracle Discover How I Made $72,144.13. Last Month Giving Away Free Training. http://a8-asy.a8ww.net/a8-ads/adftrclick?redirectid=650f274a600e14d771ac3ee… -- Powered by Outblaze

2 1

Integrate openldap with postfix
by Aravind Arjunan 04 Jul '08

04 Jul '08

hi, I had configured postfix for my mail server which is working fine. I had configured openldap on the same server and added many entries in that. It is also working fine.when i use ldapsearch i can able to view the entries etc. The users which i had created in ldap is already there in OS for postfix. I had integrated openldap with postfix, to fetch the mail infromation from openldap. like mailid,mailQuota,mailbox location etc. But when i send mail to user it is fetching from openldap at all. It is strainght away delivering to mailbox.plz help me with this issue This is my main.cf file parameters. [root@master ~]# postconf -n alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases, *ldap:aliases *command_directory = /usr/sbin config_directory = /etc/postfix daemon_directory = /usr/libexec/postfix debug_peer_level = 2 html_directory = no inet_interfaces = all mail_owner = postfix mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain mydomain = panafnet.com myhostname = master.panafnet.com mynetworks = 192.168.117.0/24, 127.0.0.0/8 myorigin = $mydomain newaliases_path = /usr/bin/newaliases.postfix queue_directory = /var/spool/postfix readme_directory = /usr/share/doc/postfix-2.3.3/README_FILES relay_domains = $mydestination relayhost = $mydomain sample_directory = /usr/share/doc/postfix-2.3.3/samples sendmail_path = /usr/sbin/sendmail.postfix setgid_group = postdrop unknown_local_recipient_reject_code = 550 *aliases_server_host = localhost aliases_server_port = 389 aliases_search_base = dc=panafnet,dc=com aliases_scope = sub aliases_bind = no aliases_query_filter = (&(objectClass=qmailUser)(mail=%s)) aliases_result_attribute = mailMessageStore aliases_timeout = 10 aliases_version = 3*

2 4

[ldap with tls] installation problem
by GanGan 03 Jul '08

03 Jul '08

Hello all, I try to install tls for ldap but without success :( I make a CA (compiled openssl) when i start ldap with : service ldap start i have this logs : May 27 20:39:29 srvtest3 slapd[19546]: @(#) $OpenLDAP: slapd 2.3.27 (Jun 27 2007 08:48:26) $ brewbuilder@ls20-bc1-13.build.redhat.com:/builddir/build/BUIL D/openldap-2.3.27/openldap-2.3.27/build-servers/servers/slapd May 27 20:39:29 srvtest3 slapd[19546]: nss_ldap: could not search LDAP server - Server is unavailable May 27 20:39:29 srvtest3 slapd[19546]: nss_ldap: could not search LDAP server - Server is unavailable May 27 20:39:29 srvtest3 slapd[19546]: /etc/openldap/slapd.conf: line 39: rootdn is always granted unlimited privileges. May 27 20:39:29 srvtest3 slapd[19546]: /etc/openldap/slapd.conf: line 44: rootdn is always granted unlimited privileges. May 27 20:39:29 srvtest3 slapd[19546]: main: TLS init def ctx failed: -1 May 27 20:39:29 srvtest3 slapd[19546]: slapd stopped. May 27 20:39:29 srvtest3 slapd[19546]: connections_destroy: nothing to destroy. my /etc/openldap/slapd.conf is : include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema # logs loglevel 4 # needed for login_ldap allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args database bdb suffix "dc=midian,dc=org" rootdn "cn=god,dc=midian,dc=org" rootpw {SSHA}EkM4ViGxzWnZQ2n5hKBBcfffFMTcCO-0E4 directory /var/lib/ldap index objectClass eq # ACL access to attrs=userPassword by self write by anonymous auth by dn="cn=god,dc=midian,dc=org" write by * none access to * by self write by dn="cn=god,dc=midian,dc=org" write by * read # CA signed certificate and server cert entries: # TLS & SSL TLSCertificateFile /etc/openldap/cacerts/srvtest3.test.org.pem TLSCertificateKeyFile /etc/openldap/cacerts/srvtest3.test.org.key TLSCACertificateFile /etc/ssl/cacert.pem TLSVerifyClient never my /etc/openldap/ldap.conf base dc=midian,dc=org uri ldap//srvtest3.test.org/ ldap_version 3 TLS_CACERT /etc/ssl/cacert.pem TLS_REQCERT demand my /etc/ldap.conf # SSL & TLS ssl start_tls #ssl on #tls_checkpeer yes # Afin que le client puisse valider l'identitéu serveur, on doit le fournir la cléublique # du CA avec laquelle il pourra éblir que le certificat du serveur a bien é signéar # la clérivéde cette mê CA. TLS_CACERT /etc/openldap/cacerts/ldap.crt # On demande élement au client de toujours valider l'identitéu serveur. TLS_REQCERT demand # IP du serveur ldap #host 127.0.0.1 uri ldap://srvtest3.test.org/ # Le DN de base pour effectuer les recherches base dc=midian,dc=org # Optimisation de recherche dans la base scope=one # Pour que le poste demarre meme si le server ldap ne repond pas bind_policy soft # Version du protocole utilise ldap_version 3 # Port ecoute serveur port 389 # Filtres de validation dun utilisateur pam_filter objectclass=account pam_filter host=srvtest3.test.org # Attribut compare avec lindentifiant de connexion de lutilisateur pam_login_attribute uid # Verification attribut host pam_check_host_attr yes # DN groupe auquel il faut appartenir pour acces machine locale pam_groupdn ou=group,dc=midian,dc=org # Definit lattribut dappartenance au groupe pam_member_attribute member # password envoi serveur pam_password crypt # Parametres nss-ldap de recherche nss_base_passwd ou=user,dc=midian,dc=org?sub nss_base_shadow ou=user,dc=midian,dc=org?sub nss_base_group ou=group,dc=midian,dc=org?sub nss_base_hosts ou=machines,dc=midian,dc=org?sub if someone could help me it would be nice sorry for my bad english - GanGan -

1 0

Quota and groupOfUniqueNames
by AlexanDER Franca 03 Jul '08

03 Jul '08

Hi all. I have a Linux + ext3 system and I'm stuck in a situtation that I can't configure any quota of groups because all my groups are groupOfUniqueNames. I'm using Plone/Zope, so, now it's essential to use groupOfUniqueNames (and not posixGroup). Is there any way to fix this mess? Maybe I'm telling stupid things (like it's not possible use groupOfUniqueNames and group quota), I really don't know. Must I change schemas or something like that? []'s Alexander Brazil - Rio de Janeiro

1 0

Performance and TLS on bind/search operations.
by k bah 03 Jul '08

03 Jul '08

Hi, I noticed binds to the LDAP server with TLS off (plain connection) generate around 14 packets, while with TLS on, generate around twice the number of packets. It's not always twice, but near that. The smtp server only does anonymous binds do LDAP, while the IMAP server always use TLS, because it makes bind with DN/passwords. I don't think about changing this setup (smtp = plain connections, imap = tls connections). My question is about other software, code me and others write, that makes queries to the same LDAP server. We want to define a standard to always use TLS on code any of us write, so we don't need to recheck the code, to find if authenticated binds are being made without TLS, or sensitive data is being passed on a LDAP query with plain text connections. We can't always be sure if sensitive data will be passed, it's not just passwords. My question is, any of you can share your experience on LDAP perfomance regarding this, whether or not to *always use TLS*? I think it's best to be sure we always use TLS, but don't know the impact on performance. For the code we write I guess it will be no more than 100 connections/hour (bind operations). That's really not much, so I think TLS on everything won't be a problem. The real load is the smtp server use of LDAP, thousands/hour, but that's all plain connections, anon bind, search operations. thanks = Manage Clusters Easier Easy to use Graphical Interface. Get 90-99% HW Utilization - Try Moab. http://a8-asy.a8ww.net/a8-ads/adftrclick?redirectid=c8db0bf13ca5dbd1a987ac0… -- Powered by Outblaze

1 0

different shells on different hosts?
by Joy Khoriaty 02 Jul '08

02 Jul '08

Hi! I'd like my LDAP users to have different shells on 2 different client machines. Is that possible? how can I set it up? e.g, on host1, user1 has for shell /bin/bash, on host2, user1 has for shell /bin/rsh Someone suggested having the defined shell for the user in their LDAP entry be called e.g. /bin/ldap_shell, and symbolic linking accordingly on each machine, but it doesn't give me the granularity I want on a per user basis Any suggestions, pointers, ideas are more than welcomed! Thanks! -- Joy Khoriaty elventails(a)elventails.com http://elventails.com

2 2

How does Openldap work with Cyrus SASL and MIT Kerberos V
by Le Trung Kien 02 Jul '08

02 Jul '08

Hi everyone, I have built up one server with Openldap, Cyrus SASL, MIT Kerberos V. Now, my server can authenticate users. In "Authentication Configuration", I set option information for LDAP server and Kerberos server. And I could login with accounts (Kerberos principals) which are created through Kerberos. And user information can be obtained from LDAP server. But it's seem to be only Openldap and Kerberos work with together. I can't figure out what the SASL role is in this strategy. And how it effects on my system. When I attempt setup phpldapadmin, I must configure SASL option, but I don't know how SASL works with LDAP in this strategy ? -- Le Trung Kien.

5 8

ldap_bind: Invalid credentials (49)
by Wael Mashal 02 Jul '08

02 Jul '08

I install the openldap on windows I add the .ldif file on ldap put the problem appear when I use c:\OpenLDAP>ldapwhoami -x -D "cn=admin,o=world" -W Enter LDAP Password: ldap_bind: Invalid credentials (49) Please help Wael Mashal Java Team Leader ASAL Technologies Ramallah, Palestine Tel: +970-2-2409 101 Fax: +970-2-2409 103 Mob: +970-52-487-11-70 Web: http://www.asaltech.com

2 1

openldap Master/slave
by Aravind Arjunan 01 Jul '08

01 Jul '08

hi i had configured openldap in rhel5 as master/slave openldap version is 2.3 Slave is not getting replicating from master. These are the logs generated in master and slave server. plz help me with this issue. At the time restarting slapd.conf in master server. [B][root@master~]# tail -f /var/log/slapd.log[/B]Jul 1 21:07:21 master slapd[2960]: daemon: shutdown requested and initiated. Jul 1 21:07:21 master slapd[2960]: slapd shutdown: waiting for 0 threads to terminate Jul 1 21:07:21 master slapd[2960]: slapd stopped. Jul 1 21:07:22 master slapd[3254]: @(#) $OpenLDAP: slapd 2.3.27 (Jan 3 2007 13:13:17) $ brewbuilder@ls20-bc1-13.build.redhat.com:/builddir/build/BUILD/openldap-2.3.27/openldap-2.3.27/build-servers/servers/slapd Jul 1 21:07:23 master slapd[3255]: slapd starting ============================================================================================================================ ###At the time of restarting the slave slapd.conf##### [root@master~]# tail -f /var/log/slapd.log Jul 1 21:08:34 master slapd[3255]: conn=0 fd=13 ACCEPT from IP= 192.168.117.5:35205 (IP=0.0.0.0:389) Jul 1 21:08:34 master slapd[3255]: conn=0 op=0 BIND dn="cn=syncuser,dc=panafnet,dc=com" method=128 *Jul 1 21:08:34 master slapd[3255]: conn=0 op=0 RESULT tag=97 err=49 text=* *Jul 1 21:08:35 master slapd[3255]: conn=0 op=1 UNBIND *Jul 1 21:08:35 master slapd[3255]: conn=0 fd=13 closed Jul 1 21:08:35 master slapd[3255]: connection_read(13): no connection! [B][root@slave ~]# tail -f /var/log/slapd.log[/B]Jun 30 10:40:36 slave slapd[6481]: daemon: shutdown requested and initiated. Jun 30 10:40:36 slave slapd[6481]: slapd shutdown: waiting for 0 threads to terminate Jun 30 10:40:36 slave slapd[6481]: slapd stopped. Jun 30 10:40:37 slave slapd[6758]: @(#) $OpenLDAP: slapd 2.3.27 (Jan 3 2007 13:13:17) $ brewbuilder@ls20-bc1-13.build.redhat.com:/builddir/build/BUILD/openldap-2.3.27/openldap-2.3.27/build-servers/servers/slapd Jun 30 10:40:38 slave slapd[6759]: slapd starting *Jun 30 10:40:38 slave slapd[6759]: do_syncrep1: ldap_sasl_bind_s failed (49)* * *

2 1

me
by Aravind Arjunan 01 Jul '08

01 Jul '08

hi, i had configured openldap and postfix in rhel 5. I had not installed any source code for the above two. With the help of rpm only i had configured ldap and postfix. Now i need to integrate openldap with postfix. I had followed the redhat documents for integrating. I want to know wheather it is necessary to complie ldap with postfix source code instead of rpm's? and kindly tell what mistake i had made here? plz look the error which am getting while sending mail to user who is located in ldap database. This is my configuration paramaters: ===================================== alias_maps = hash:/etc/postfix/aliases, ldap:ldapaliases alias_database = hash:/etc/postfix/aliases, ldap:ldapaliases ldapaliases_server_host = localhost ldapaliases_server_port = 389 ldapaliases_search_base = dc=panafnet,dc=com ldapaliases_scope = sub ldapaliases_query_filter = (|(mailid=%s)) ldapaliases_result_attribute = maildrop Error in maillog ================= Jul 1 17:18:05 experts postfix/cleanup[7422]: 900CFFDFE1: message-id=< 20080701114805.900CFFDFE1(a)experts.panafnet.com> Jul 1 17:18:05 experts postfix/qmgr[7416]: 900CFFDFE1: from=< root(a)panafnet.com>, size=310, nrcpt=1 (queue active) Jul 1 17:18:05 experts postfix/local[7424]: warning: dict_ldap_lookup: ldapaliases: Search base '' not found: 32: No such object Jul 1 17:18:05 experts postfix/local[7424]: 900CFFDFE1: to=< aravind(a)panafnet.com>, orig_to=<aravind>, relay=local, delay=0, status=deferred (alias database unavailable)

2 1

me
by Aravind Arjunan 01 Jul '08

01 Jul '08

hi, I had configured openldap 2.3 in RHEL 5 operating system. I had configured in master/slave. I want where can i fing the ldap logs. i had tried in /var/log/messages, but no logs were generating there. plz guide me where to find the ldap logs.

3 2

openldap
by Aravind Arjunan 01 Jul '08

01 Jul '08

hi, I got problem in openldap master,slave replication. I had configured openldap in RHEL 5 as master/slave in syncrepl method ( refreshOnly) my problem is my slave server is not getting replicated with master. I had integrated openldap with postfix also,so when i restart the postfix service i get the below error which i mentioned. plz help me with this issue. # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/qmail.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: # modulepath /usr/lib64/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCertificateFile /etc/pki/tls/certs/slapd.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # access to attrs=userPassword by self write by dn="cn=syncuser,dc=panafnet,dc=com" read by * auth access to * by dn="cn=syncuser,dc=panafnet,dc=com" read by * read # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=panafnet,dc=com" rootdn "cn=Manager,dc=panafnet,dc=com" rootpw {SSHA}9ma4wkvWQM2ws7E9q7qIgK9vQ2Rp4IhZ # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap/panafnet.com # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index default sub index entryCSN,entryUUID eq # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM overlay syncprov syncprov-checkpoint 100 05 [root@master ~]# ============================================================================= /etc/ldap.conf(master) ============================================================================== #host 127.0.0.1 host 192.168.117.4 192.168.117.5 # The distinguished name of the search base. base dc=panafnet,dc=com # The distinguished name to bind to the server with. # Optional: default is to bind anonymously. binddn dc=panafnet,dc=com # The credentials to bind with. # Optional: default is no credential. bindpw secret # may incur a small performance impact. nss_base_passwd ou=People,dc=panafnet,dc=com?one nss_base_shadow ou=People,dc=panafnet,dc=com?one nss_base_group ou=Group,dc=panafnet,dc=com?one #nss_base_hosts ou=Hosts,dc=example,dc=com?one #nss_base_services ou=Services,dc=example,dc=com?one # SASL mechanism for PAM authentication - use is experimental # at present and does not support password policy control #pam_sasl_mech DIGEST-MD5 #uri ldap://127.0.0.1/ ssl no tls_cacertdir /etc/openldap/cacerts pam_password md5 ================================================================================== /etc/openlldap/slapd.conf(slave) =================================================================================== # network or connect timeouts (see bind_timelimit). host 192.168.117.5 192.168.117.4 # The distinguished name of the search base. base dc=panafnet,dc=com # The distinguished name to bind to the server with. # Optional: default is to bind anonymously. binddn dc=panafnet,dc=com # The credentials to bind with. # Optional: default is no credential. bindpw secret # to append the default base DN but this # may incur a small performance impact. nss_base_passwd ou=People,dc=panafnet,dc=com?one nss_base_shadow ou=People,dc=panafnet,dc=com?one nss_base_group ou=Group,dc=pananfet,dc=com?one #nss_base_hosts ou=Hosts,dc=example,dc=com?one ssl no tls_cacertdir /etc/openldap/cacerts ===================================================================================== Note: I had integrated ldap with postfix. So when am restart my postfix service i got this error in logs. Jul 1 16:05:59 master postfix/postfix-script: stopping the Postfix mail system Jul 1 16:05:59 master postfix/master[6303]: terminating on signal 15 Jul 1 16:06:01 master postfix/postfix-script: starting the Postfix mail system Jul 1 16:06:02 master postfix/master[1283]: daemon started -- version 2.3.3, configuration /etc/postfix Jul 1 16:06:02 master postfix/pickup[1284]: nss_ldap: failed to bind to LDAP server ldap://192.168.117.4: Invalid credentials Jul 1 16:06:02 master postfix/qmgr[1285]: nss_ldap: failed to bind to LDAP server ldap://192.168.117.4: Invalid credentials Jul 1 16:06:02 master postfix/pickup[1284]: nss_ldap: failed to bind to LDAP server ldap://192.168.117.5: Invalid credentials Jul 1 16:06:02 master postfix/pickup[1284]: nss_ldap: could not search LDAP server - Server is unavailable Jul 1 16:06:02 master postfix/pickup[1284]: nss_ldap: failed to bind to LDAP server ldap://192.168.117.4: Invalid credentials Jul 1 16:06:02 master postfix/qmgr[1285]: nss_ldap: failed to bind to LDAP server ldap://192.168.117.5: Invalid credentials Jul 1 16:06:02 master postfix/qmgr[1285]: nss_ldap: could not search LDAP server - Server is unavailable Jul 1 16:06:02 master postfix/pickup[1284]: nss_ldap: failed to bind to LDAP server ldap://192.168.117.5: Invalid credentials Jul 1 16:06:02 master postfix/pickup[1284]: nss_ldap: could not search LDAP server - Server is unavailable Jul 1 16:06:02 master postfix/qmgr[1285]: nss_ldap: failed to bind to LDAP server ldap://192.168.117.4: Invalid credentials Jul 1 16:06:02 master postfix/qmgr[1285]: nss_ldap: failed to bind to LDAP server ldap://192.168.117.5: Invalid credentials Jul 1 16:06:02 master postfix/qmgr[1285]: nss_ldap: could not search LDAP server - Server is unavailable # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: # modulepath /usr/lib64/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCertificateFile /etc/pki/tls/certs/slapd.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=panafnet,dc=com" rootdn "cn=Manager,dc=panafnet,dc=com" rootpw {SSHA}F/VF2kcFeRzWxmYddG2JryM/0odBN7Hy # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap/panafnet.com syncrepl rid=0 provider=ldap://192.168.117.4:389 binddn="dc=panafnet,dc=com" bindmethod=simple credentials=SyncUser searchbase="dc=panafnet,dc=com" filter="(objectClass=*)" attrs="*" schemachecking=off scope=sub type=refreshOnly interval=00:00:00:06 access to attrs=userPassword by dn="cn=syncuser,dc=panafnet,dc=com" write by * auth access to * by dn="cn=syncuser,dc=panafnet,dc=com" write by * read # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index default sub index entryCSN,entryUUID eq # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM [root@slave ~]# ===================================================================================== /etc/ldap.conf(slave ======================================================================================

1 0

Comments requested on some support for LDAP I received from Konica Minolta.
by Neil Marjoram 30 Jun '08

30 Jun '08

I would really like to here the groups comments on this email I received from KonicaMinolta, it refers to the Bizhub C451 printer, but I suspect it applies to the whole range. On purchase of the printer I was told it supports LDAP, and as you may expect this response somewhat annoys me! quote "Thank you for your observations, We have now received a reply from our colleagues in Germany and they have confirmed the following concerning LDAP compatibility on KonicaMinolta machines: "In a Windows environment, it will work fine, but as soon as Open Source is used, it may fail. The current limitation for LDAP is --> LDAP user authentication "user name field" --> 64 char LDAP address search "user name field" --> 254 char All Windows based LDAP V3 compatible Servers are supported. A problem may occur if within the reply string from the Server special Characters which are not corresponding to RFC 3986 are used. E.g. "^" sign within the names." Support for Open Source is something they are looking into but for now there is no due date. With regard to your question on "Referral Setting" "Referral Settings" Means to have an object stored in a local tree which is defined with certain (local&specific) attributes and with a referral to another object in a central tree which contains the (global) attributes (e.g name, email,..) Unfortunately Hotline are unable to offer any further assistance concerning this matter as we are only familiar with Windows based LDAP connections from our range of Machines and suggest you refer back to the open source community." Thanks for your comments on this, Neil -- Neil Marjoram Systems Manager Adastral Park Campus University College London Ross Building Adastral Park Martlesham Heath Ipswich - Suffolk IP5 3RE Tel: 01473 663711 Fax: 01473 635199 Reclaim Your Inbox! http://www.mozilla.org/products/thunderbird

4 5

OpenLDAP+Samba server to authenticate windows machines
by Gustavo Mendes de Carvalho 29 Jun '08

29 Jun '08

Hi Everyone , I'm planning to mount an OpenLDAP+Samba server to authenticate windows machines, but I have a not so common situation. I have windows machines that does not belong either to some windows domain or workgroup, machines that belongs to some workgroup and meny machines that belongs to some specific and different domains, whitout trusted relantionship among them, including some windows cluster machines. Is there any way to include all of them to authenticate in a single LDAP+Samba server ? I mean, to use samba without PDC or BDC or even some DC configured in Samba server... I know that this question should be posted in Samba maillist, and I already did it, but does anybody here know something about this ? Thanks in advance --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com

2 1

Problem while inserting binary data....
by ashish mahamuni 29 Jun '08

29 Jun '08

I've define my own schema(couple of classes and attributes).... it looks like below... --------------------------------------------------------------- attributetype ( 2.5.4.73 NAME 'epType' SUP name ) attributetype ( 2.5.4.74 NAME 'agencyIcon' SUP jpegPhoto ) objectClass ( 2.5.6.24 NAME 'mlnkEp' DESC 'Object for end point' STRUCTURAL MUST ( epType ) objectClass ( 2.5.6.25 NAME 'agencyObject' DESC 'Object that extends organizationalUnit' SUP organizationalUnit STRUCTURAL MAY (agencyIcon) ) ------------------------------------------------------------ I want to store icon file in agencyIcon attribute... So I added below line for agencyIcon in ldif file ......... agencyIcon;binary: < file:///root/jbuilder.ico When I execute command: slapadd -l init.ldif I get error as..... <= str2entry: str2ad(version): attribute type undefined slapadd: could not parse entry (line=8) When I use ldapadd/ldapmodify I get following error ldap_add: Undefined attribute type (17) additional info: agencyIcon;binary: option "binary" not supported with type I also tried adding below line at the top of ldif file I also tried changing version number as 1,2,3 version: 1 I searched on google but found nothing... I am working on Cent-OS. And openldap version is 2.3.27 Help me Regards Ashish Best Jokes, Best Friends, Best Food and more. Go to http://in.promos.yahoo.com/groups/bestofyahoo/

3 5

Migration from Sun Directory Server to OpenLDAP.
by Jayesh Kamdar 27 Jun '08

27 Jun '08

Hi, I am kind of newbie to LDAP. I do have little experience with Sun LDAP but not an expert. Now, I am being asked to move over Sun ldap servers to OpenLDAP. I am looking for any pointers, document or if any one has personal experience on how easy/tough it is to do this migration from SunLDAP to OpenLDAP. Thanks for your help. Jayesh Kamdar jkamdar(a)yahoo.com

2 1

ldap error
by Aravind Arjunan 27 Jun '08

27 Jun '08

hi, I had integrated ldap with postfix in rhel 5 operating system. But when i try to send mail to user which i mentioned in ldap database. i got the below error. Jun 27 00:02:42 master postfix/pickup[3753]: C4FC51FB85: uid=0 from=<root> Jun 27 00:02:42 master postfix/cleanup[3831]: C4FC51FB85: message-id=< 20080626183242.C4FC51FB85(a)master.panafnet.com> Jun 27 00:02:42 master postfix/qmgr[3754]: C4FC51FB85: from=< root(a)panafnet.com>, size=326, nrcpt=1 (queue active) Jun 27 00:02:42 master postfix/local[3760]: warning: dict_ldap_lookup: ldapaliases: Search base '' not found: 32: No such object Jun 27 00:02:42 master postfix/local[3760]: C4FC51FB85: to=< rambo(a)panafnet.com>, orig_to=<rambo>, relay=local, delay=0.22, delays=0.19/0/0/0.03, dsn=4.3.0, status=deferred (alias database unavailable)

2 1

ldap error
by Aravind Arjunan 27 Jun '08

27 Jun '08

hi, I had configured openldap as master/slave in one of the customer site. But still the slave server was not ready in customer site, i had configured the master server part alone. After finishing the configuration part of master server i had restarted the ldap service. am getting the warning message as warning:line 58: no by claust(s) specify in access line (ignored) warning:line 64: no by claust(s) specify in access line (ignored) the below are the line 58 and 64 access to attrs=userPassword by self write by dn="cn=syncuser,dc=example,dc=com" read by * auth access to * by dn="cn=syncuser,dc=example,dc=com" read by * read

1 0

Problem with Chaining
by RamakrishnaDeepak Battu 27 Jun '08

27 Jun '08

Hi all, I'm a newbie. I recently installed openldap2.4.10 on 2 of my systems.My requirement is to chain the master database on to the slave database..I followed the manual and tried the folowing .The Master and Slave slapd.conf's are as follows: *The Master config file is as follows: *#include statments ......... ......... access to * by dn.base="cn=root,ou=Users,dc=example,dc=com" read by * break ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=example,dc=com" rootdn "cn=root,dc=example,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq overlay syncprov # contextCSN saved to database every 100 updates or ten minutes syncprov-checkpoint 100 10 *The Slave config file as folows: *#include statments ......... ......... ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=example,dc=com" rootdn "cn=root,dc=example,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq syncrepl rid=100 provider=ldap://Master type=refreshAndPersist retry="5 5 300 +" searchbase="dc=example,dc=com" attrs=* bindmethod=simple binddn="cn=root,ou=Users,dc=example,dc=com" credentials="<secret>" updateref "ldap://Master" ----------------------------------------------------------------------------------- After this i started the Master server and slave Server with -d 256 option to see like this: *master log:* ber_get_next on fd 12 failed errno=0 (Success) connection_read(12): input error=-2 id=5, closing. connection_closing: readying conn=5 sd=12 for close connection_close: deferring conn=5 sd=12 daemon: activity on 1 descriptor conn=5 op=1 do_unbind daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL connection_resched: attempting closing conn=5 sd=12 connection_close: conn=5 sd=12 daemon: removing 12 *slave log:* slapd starting request done: ld 0x8238850 msgid 1 do_syncrep1: rid 100 ldap_sasl_bind_s failed (49) do_syncrepl: rid 100 retrying (4 retries left) request done: ld 0x8238850 msgid 1 do_syncrep1: rid 100 ldap_sasl_bind_s failed (49) do_syncrepl: rid 100 retrying (3 retries left) request done: ld 0x8238850 msgid 1 do_syncrep1: rid 100 ldap_sasl_bind_s failed (49) do_syncrepl: rid 100 retrying (2 retries left) request done: ld 0x8238850 msgid 1 do_syncrep1: rid 100 ldap_sasl_bind_s failed (49) do_syncrepl: rid 100 retrying (1 retries left) request done: ld 0x8238850 msgid 1 do_syncrep1: rid 100 ldap_sasl_bind_s failed (49) do_syncrepl: rid 100 retrying ------------------------------------------------------------------------------- It means that the slave is not being replicated .. can any one please tell me why this ldap_sasl_bind_s failed (49) is coming.. thanks in advance.

2 1

Re: ppolicy by group
by Jeroen van Aart 26 Jun '08

26 Jun '08

(I originally posted this on openldap-software, posting it to technical, since it seems to allow this type of discussion) Gavin Henry wrote: > If you don't have a default ppolicy defined and no pwdPolicySubentry > then slapd will perform as it is currently configured. Thanks I got it more or less working. But only ssh seems to obey it so far (I set pam_lookup_policy to yes). I would like to know if anyone had success to make other frequently used software to obey the password policy. Such as imap, MTAs, webservers, especially if used through pam. Thank you, Jeroen

3 7

Re: slapd replication (push based)
by Martin Simovic 26 Jun '08

26 Jun '08

On Thu, 2008-06-26 at 14:06 +0100, Gavin Henry wrote: > msimovic(a)concurrent-thinking.com wrote: > > > > On Tue, 24 Jun 2008 09:40:24 -0700, Howard Chu <hyc(a)symas.com> wrote: > >> Martin Simovic wrote: > >>> Hi, > >>> > >>> I have the following setup > >>> > >>> LAN --- slapd 2.4.7 (master) --- DMZ ---slapd 2.3.30 (slave) > >>> > >>> I'm trying to achieve replication from master to slave. > >>> the firewall policy is LAN-->DMZ allow > >>> DMZ-->LAN reject > >>> > >>> this was actually very easy with slurpd (removed from 2.4) as the only > >>> need was to allow TCP traffic from master to slave > >>> > >>> with syncrepl it seems to me that no matter if I use push/pull method > >>> the client (slave) is the one that binds to the master (provider). this > >>> means that firewall rule that allows TCP traffic to LAN is needed - this > >>> is very ugly. > >>> > >>> is there a way to workaround this (or did i just misunderstand the whole > >>> problem) > >> See the configuration used in test045 in the test suite. > > > > thanks for the answer. > > > > the truth is, i´ve alrady been through the test045 but can´t understand > > what > > is going on there. the openldap admin guide seems to be a lot more verbose > > about much simpler subjects and very sparse about something which does not > > seem so straightforward (and used to be so simple in slurpd times). > > > > my scenario seems pretty usual (like secured rw copy of DIT on lan, while > > read > > only copy on dmz - for mail server, apache auth, etc.) > > in this very usual and IMHO wise setup the DMZtoLAN traffic is undesirable. > > > > and yet there is no solid documentation in admin guide. > > > > any pointers to documentation would be much appreciated. > > > > Did you see: > > http://www.openldap.org/doc/admin24/replication.html#Push%20Based > > It really does need cleaning up. > > Thanks. > Yes, it's really messy. actually my desperate need for this made me overcome my laziness. i compiled the slapd from source, run the tests, immediately after the test045 copied the slapd.1. ...slapd.3.conf files. this made me understand what is really going on there. my understanding is that i need to run two instances of slapd on master (master + proxy) proxy is pulling down changes from master and stores them in it's backend (ldap backend pointing to slave server) all the rest is question of acl's. can you correct me please, if i'm wrong. trying to implement it right now. M.

1 0

contextCSN question, three attributes on single naming context
by Josh Miller 25 Jun '08

25 Jun '08

I'm chasing down an issue with multi-master replication on OpenLDAP 2.4.10 and I issue the following search to compare the contextCSN. Is there any reason to have 3 contextCSN attributes, and one of them looks like a base64 encoded string, that doesn't look right. Is this expected behavior? -4- user@f8-workstation ~ > > ldapsearch -xZZH ldap://server01.example.com -D "cn=manager,dc=openldap,dc=example,dc=com" -W -z 1 contextCSN dn: dc=openldap,dc=example,dc=com -LLL Enter LDAP Password: dn: dc=openldap,dc=example,dc=com contextCSN: 20080527205300.158966Z#000000#000#000000 contextCSN: 20080619202050.412763Z#000000#004#000000 contextCSN: 20080623172814.327835Z#000000#003#000000 Size limit exceeded (4) -4- user@f8-workstation ~ > > ldapsearch -xZZH ldap://server03.example.com -D "cn=manager,dc=openldap,dc=example,dc=com" -W -z 1 contextCSN dn: dc=openldap,dc=example,dc=com -LLL Enter LDAP Password: dn: dc=openldap,dc=example,dc=com contextCSN:: qBiaszA2MTIxNzMyMzMuMTA1MTA2WiMwMDAwMDAjMDAzIzAwMDAwMA== contextCSN: 20080620213035.498183Z#000000#004#000000 contextCSN: 20080527205300.158966Z#000000#000#000000 Size limit exceeded (4) TIA, -- Josh Miller, RHCE

2 1

Re: Need to configure openLDAP client to request authenication in LDAP version 2 format
by kenglund 25 Jun '08

25 Jun '08

Thank you all for your help. I found out the out mail server is a CommuniGate Pro version 4.x - an old version. This is why we have had to modify our code to work with its weird format. The code I need to change is down in the Plone "LDAP User Folder" software - written in Python. It is apparently not using openLDAP at all. I would love to either upgrade our Communigate Pro software to the newest release (which would work, but is costly), or go to openLDAP for authentication (which is free, but takes more time than we have right now). Sorry to take up your time and energies. Ken

1 0

schema file
by Aravind Arjunan 25 Jun '08

25 Jun '08

hi, I tried to extend my schema but getting errors.I had created a separate schema file called attr.schema file. This is the schema file, in that i had mentioned mailbox location and mailQuota and mailalternateaddress attribute. But when i restart the ldap service, i get [root@master schema]# service ldap restart Stopping slapd: [FAILED] Checking configuration files for slapd: /etc/openldap/schema/att.schema: line 3 : AttributeType SYNTAX or SUPerior required: "1.3.6.1.4.1.4203.666.1.100.124" slaptest: bad configuration file! [FAILED] # New attribute definitions: attributetype ( 1.3.6.1.4.1.4203.666.1.100.124 ) NAME 'mailboxlocation' DESC 'RFC2798: Where the mails are located' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE attributetype ( 1.3.6.1.4.1.4203.666.1.100.125 ) NAME 'mailQuota' DESC 'RFC2798: User level Quota' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE attributetype ( 1.3.6.1.4.1.4203.666.1.100.125 NAME 'mailalternateaddress' SUP mail ) objectClass ( 1.3.6.1.4.1.4203.666.1.100 NAME 'YoLinuxPerson' DESC 'X-Person' SUP inetOrgPerson STRUCTURAL MAY ( mailboxlocation $ mailQuota $ birthdate ) )

2 1

Issue with Referral+pwdReset
by Anthony Porcano 25 Jun '08

25 Jun '08

I am having a problem that I am hoping the list can help with. When using the pwdReset attribute to force a password change the user receives the following error when trying to reset the password on SSH login: LDAP password information update failed: Can't contact LDAP server passwd: Permission denied This only occurs for clients using a slave to authenticate, and only when changing the password on login in combination with the pwdReset attribute. A non-forced password change works fine when a user runs the passwd command manually on one of the slave clients. So it seems referrals by themselves work OK. Forced password changes using the pwdReset attr also work for clients that use the master directly, so the issue is specific to slave-authentication+pwdReset+referral. The debug log on the master shows that it is being reached by the client, but slapd refused to perform the action: slapd[1079]: conn=1 op=1 BIND dn="uid=jschmo,ou=users,dc=example,dc=com" method=128 slapd[1079]: conn=1 op=1 RESULT tag=97 err=53 text=unauthenticated bind (DN with no password) disallowed The debug log on the slave shows the following error: slapd[11339]: conn=5 op=10 MOD dn="uid=jschmo,ou=users,dc=example,dc=com" slapd[11339]: conn=5 op=10 MOD attr=userPassword slapd[11339]: conn=5 op=10 RESULT tag=103 err=10 text= I've tried searching for information on this, but to date nothing I have found resolved the issue. One attempt involved setting an allow statement in the master slapd.conf for "bind_anon_dn". This did prevent the err=53, but produced another error: Jun 19 12:21:12 admin5-ash slapd[30555]: conn=4 op=2 RESULT tag=103 err=8 text=modifications require authentication The following applies to both master and slave servers: OpenLDAP: openldap-2.3.39-3.rhel5 (Buchan's Packages) OS: Centos 5.1 For the client I have tried the following configurations: OpenLDAP: openldap-2.2.13-8 (RH Stock) PAM_LDAP: nss_ldap-226-20 (RH Stock) OS: RHEL4.6 OpenLDAP version: openldap-2.3.39-3.rhel5 (Buchan's Packages) PAM_LDAP: nss_ldap-253-5.el5 (Centos Stock) OS: Centos 5.1 If any other information is needed let me know. Thanks to all. --AP

2 2

LDAP Update Script
by Aravind Arjunan 25 Jun '08

25 Jun '08

Dear all, I had configured openldap in RHEL 5 operating system in master slave. Its working fine and entries are also adding without any problem. But i need to add entries for 15000 users. So it is hard for me to add in ldap browser or in command line for these much users. So i need to know is there any script or utility is there to add all the users entries at a time like adding all the entries in text file and update it by a command. if it so plz tell me it will be very helpfull for me.

2 1

Need to configure openLDAP client to request authenication in LDAP version 2 format
by kenglund 25 Jun '08

25 Jun '08

Hello, I am installing a new version of our Zope/Plone software for hosting our web portal. The new software is using a product called PloneLDAP, which (I think) in turn requests authentication using openLDAP client. openLDAP is authenticating through our mail server, which wants bind requests in version 2 format. Modification of the mail server software to use version 3 authentication does not seem to be an option, as (according to my Tech guy) it is "really not LDAP", but has an "LDAP Like" interface. The interface requires the bind to look like this: ldapConnection, userid, password not in version 3 format, which looks like this: ldapConnection, uid="userid", password I have tried to force openLDAP client to perform bind requests using the "ldap_version 2" parameter in the /usr/local/etc/openldap/ldap.conf system-wide ldap configuration file, and also in a .ldaprc file stored in the Zope working directory. Neither seem to work. Can anyone tell me how to successfully configure openLDAP to send a version 2 bind request? Thanks! Ken

7 10

slapd replication (push based)
by Martin Simovic 24 Jun '08

24 Jun '08

Hi, I have the following setup LAN --- slapd 2.4.7 (master) --- DMZ ---slapd 2.3.30 (slave) I'm trying to achieve replication from master to slave. the firewall policy is LAN-->DMZ allow DMZ-->LAN reject this was actually very easy with slurpd (removed from 2.4) as the only need was to allow TCP traffic from master to slave with syncrepl it seems to me that no matter if I use push/pull method the client (slave) is the one that binds to the master (provider). this means that firewall rule that allows TCP traffic to LAN is needed - this is very ugly. is there a way to workaround this (or did i just misunderstand the whole problem) thanks, Martin.

3 2

Odd password reset issue
by Kevin Brammer 22 Jun '08

22 Jun '08

Running the OpenLDAP server bundled with RH ES3. I had OpenLDAP running successfully. I could authenticate, pull information from the directory - everything seemed great! After the 90 day password rule I had put in place, I got the "your password has expired" message. I tried to change it, said it was successful. A subsequent login received the same message. Again I changed it, and it said successful. Now, I can't even login. I changed my user's password as root using ldappasswd, and a check of the entry shows the hash changing accordingly. However, I still can't login as the user. Any ideas?

3 2

newbie question: which objectClass?
by Stefano Zanmarchi 20 Jun '08

20 Jun '08

Hi, I'd like to set up a minimal ldap server just for authentication (bind) purposes. No attributes need to be stored apart from uid and userPassword. I'd like to insert entries like dn: uid=john.smith(a)myorg.com,ou=people,dc=myorg,dc=com objectClass: ????? uid: john.smith(a)myorg.com userPassword: secret (If I use objectClass: inetOrgPerson I need to enter cn and sn as well, which I don't wont) Can I achieve this? Thanks a lot, Stefano

3 2

Authenticating from MacOS X 10.5.3 to OpenLDAP
by Jason Keltz 20 Jun '08

20 Jun '08

I have spent 2+ days trying to get a MacOS 10.5.3 machine configured to authenticate against a basic openldap 2.4.10 server with SSL on a Linux box - no SASL, no kerberos - I was hoping it would be trivial, and from the looks of all the postings around on the web, it should be. I know I'm doing the right things, yet I must be missing one minor detail. I did the initial openldap setup, and within a very short time, I was able to authenticate the MacOS box against the Linux box NON-SSSL without any trouble. When I enable SSL on the Mac, I can use ldapsearch to probe the whole ldaps:// server without any trouble at all. On the Mac, I can verify the SSL certificate: openssl s_client -connect server:636 -CApath /certs (I've created the proper hash files for the parts of the CA path) and I can see: . . Verify return code: 0 (ok) In the /etc/openldap/ldap.conf on the MAC, I have: TLS_REQCERT demand (MAC default) TLS_CACERTDIR /certs (Even if I change "TLS_REQCERT to never", it doesn't make any difference.) When I'm in the "Directory Utility" and creating a new connection, I click "Continue", then it hangs for a bit, and just comes back. The connection doesn't work. The slapd.config on the Linux side has all the correct TLS paths as well (of course if it didn't, my ldapsearch -x queries wouldn't even work): TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificatePath /openssl/certs TLSCertificateFile /openssl/certs/mycert.pem TLSCertificateKeyFile /openssl/certs/mycert.pem (The certificate and key are appended together in mycert.pem - that seems to be allowed) The certificate is a paid one - not a self-signed one. Here's the openldap debug info that is printed while I'm waiting for initialization of the connection ... I do see: TLS: can't accept. connection_read(14): TLS accept failure error=-1 id=0, closing connection_closing: readying conn=0 sd=14 for close ... but I just don't understand why given that everything seems set up properly. If it wasn't, why would the ldapsearch work!? Thanks! jas. ------ verbose openldap debugging output connection_get(15) connection_get(15): got connid=1 connection_read(15): checking for input on id=1 TLS trace: SSL_accept:before/accept initialization tls_read: want=11, got=11 tls_read: want=107, got=107 TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A tls_write: want=4096, written=4096 TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write server done A tls_write: want=723, written=723 TLS trace: SSL_accept:SSLv3 flush data tls_read: want=5 error=Resource temporarily unavailable TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS trace: SSL_accept:error in SSLv3 read client certificate A daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(15) connection_get(15): got connid=1 connection_read(15): checking for input on id=1 tls_read: want=5, got=5 tls_read: want=134, got=134 TLS trace: SSL_accept:SSLv3 read client key exchange A tls_read: want=5, got=5 tls_read: want=1, got=1 tls_read: want=5, got=5 tls_read: want=48, got=48 TLS trace: SSL_accept:SSLv3 read finished A TLS trace: SSL_accept:SSLv3 write change cipher spec A TLS trace: SSL_accept:SSLv3 write finished A tls_write: want=59, written=59 TLS trace: SSL_accept:SSLv3 flush data connection_read(15): unable to get TLS client DN, error=49 id=1 daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(15) connection_get(15): got connid=1 connection_read(15): checking for input on id=1 ber_get_next tls_read: want=5, got=5 tls_read: want=32, got=32 TLS trace: SSL3 alert read:warning:close notify ldap_read: want=8, got=0 ber_get_next on fd 15 failed errno=0 (Success) connection_read(15): input error=-2 id=1, closing. connection_closing: readying conn=1 sd=15 for close daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_close: conn=1 sd=15 daemon: removing 15 tls_write: want=37, written=37 TLS trace: SSL3 alert write:warning:close notify daemon: activity on 1 descriptor daemon: activity on: 14r daemon: read active on 14 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(14) connection_get(14): got connid=0 connection_read(14): checking for input on id=0 TLS trace: SSL_accept:before/accept initialization tls_read: want=11, got=0 TLS: can't accept. connection_read(14): TLS accept failure error=-1 id=0, closing connection_closing: readying conn=0 sd=14 for close connection_close: conn=0 sd=14 daemon: removing 14 daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(8): daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 busy daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL >>> slap_listener(ldap:///) daemon: listen=8, new connection on 14 daemon: added 14r (active) listener=(nil) daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(8): daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 busy daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL >>> slap_listener(ldap:///) daemon: activity on 1 descriptor daemon: activity on: daemon: listen=8, new connection on 15 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 daemon: added 15r (active) listener=(nil) daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(15) connection_get(15): got connid=3 connection_read(15): checking for input on id=3 ber_get_next ldap_read: want=8, got=8 ldap_read: want=94, got=94 ber_get_next: tag 0x30 len 100 contents: ber_dump: buf=0x82b9598 ptr=0x82b9598 end=0x82b95fc len=100 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=3 op=0 do_search daemon: activity on 1 descriptor ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x82b9598 ptr=0x82b959b end=0x82b95fc len=97 >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> SRCH "" 0 0begin get_filter PRESENT ber_scanf fmt (m) ber: ber_dump: buf=0x82b9598 ptr=0x82b95ae end=0x82b95fc len=78 end get_filter 0 ber_scanf fmt ({M}}) ber: ber_dump: buf=0x82b9598 ptr=0x82b95bb end=0x82b95fc len=65 daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL => test_filter => access_allowed: search access to "" "objectClass" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => send_search_entry: conn 3 dn="" => access_allowed: read access to "" "entry" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "" "namingContexts" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) ber_flush2: 54 bytes to sd 15 ldap_write: want=54, written=54 <= send_search_entry: conn 3 exit. send_ldap_result: conn=3 op=0 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=1 tag=101 err=0 ber_flush2: 14 bytes to sd 15 ldap_write: want=14, written=14 daemon: activity on 1 descriptor daemon: activity on: 14r daemon: read active on 14 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(14) connection_get(14): got connid=2 connection_read(14): checking for input on id=2 ber_get_next ldap_read: want=8, got=0 ber_get_next on fd 14 failed errno=0 (Success) connection_read(14): input error=-2 id=2, closing. connection_closing: readying conn=2 sd=14 for close connection_close: conn=2 sd=14 daemon: removing 14 daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(15) connection_get(15): got connid=3 connection_read(15): checking for input on id=3 ber_get_next ldap_read: want=8, got=8 ldap_read: want=50, got=50 ber_get_next: tag 0x30 len 56 contents: ber_dump: buf=0x82cab08 ptr=0x82cab08 end=0x82cab40 len=56 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=3 op=1 do_search ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x82cab08 ptr=0x82cab0b end=0x82cab40 len=53 >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> SRCH "" 0 0begin get_filter daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL PRESENT ber_scanf fmt (m) ber: ber_dump: buf=0x82cab08 ptr=0x82cab1e end=0x82cab40 len=34 end get_filter 0 ber_scanf fmt ({M}}) ber: ber_dump: buf=0x82cab08 ptr=0x82cab2b end=0x82cab40 len=21 => test_filter => access_allowed: search access to "" "objectClass" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => send_search_entry: conn 3 dn="" => access_allowed: read access to "" "entry" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "" "subschemaSubentry" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "" "subschemaSubentry" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) ber_flush2: 48 bytes to sd 15 ldap_write: want=48, written=48 <= send_search_entry: conn 3 exit. send_ldap_result: conn=3 op=1 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=2 tag=101 err=0 ber_flush2: 14 bytes to sd 15 ldap_write: want=14, written=14 daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(15) connection_get(15): got connid=3 connection_read(15): checking for input on id=3 ber_get_next ldap_read: want=8, got=8 ldap_read: want=71, got=71 ber_get_next: tag 0x30 len 77 contents: ber_dump: buf=0x82b9578 ptr=0x82b9578 end=0x82b95c5 len=77 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=3 op=2 do_search ber_scanf fmt ({miiiib) ber: daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL ber_dump: buf=0x82b9578 ptr=0x82b957b end=0x82b95c5 len=74 >>> dnPrettyNormal: <cn=Subschema> => ldap_bv2dn(cn=Subschema,0) <= ldap_bv2dn(cn=Subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=subschema)=0 <<< dnPrettyNormal: <cn=Subschema>, <cn=subschema> SRCH "cn=Subschema" 0 0begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0x82b9578 ptr=0x82b959a end=0x82b95c5 len=43 end get_filter 0 ber_scanf fmt ({M}}) ber: ber_dump: buf=0x82b9578 ptr=0x82b95b4 end=0x82b95c5 len=17 => test_filter => access_allowed: search access to "cn=Subschema" "objectClass" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => send_search_entry: conn 3 dn="cn=Subschema" => access_allowed: read access to "cn=Subschema" "entry" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) ber_flush2: 16753 bytes to sd 15 ldap_write: want=16753, written=13032 ldap_write: want=3721, written=3721 <= send_search_entry: conn 3 exit. send_ldap_result: conn=3 op=2 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=3 tag=101 err=0 ber_flush2: 14 bytes to sd 15 ldap_write: want=14, written=14 daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(15) connection_get(15): got connid=3 connection_read(15): checking for input on id=3 ber_get_next ldap_read: want=8, got=8 ldap_read: want=111, got=111 ber_get_next: tag 0x30 len 117 contents: ber_dump: buf=0x82ba928 ptr=0x82ba928 end=0x82ba99d len=117 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL conn=3 op=3 do_search ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x82ba928 ptr=0x82ba92b end=0x82ba99d len=114 >>> dnPrettyNormal: <dc=cse,dc=yorku,dc=ca> => ldap_bv2dn(dc=cse,dc=yorku,dc=ca,0) <= ldap_bv2dn(dc=cse,dc=yorku,dc=ca)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=cse,dc=yorku,dc=ca)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=cse,dc=yorku,dc=ca)=0 <<< dnPrettyNormal: <dc=cse,dc=yorku,dc=ca>, <dc=cse,dc=yorku,dc=ca> SRCH "dc=cse,dc=yorku,dc=ca" 2 0begin get_filter AND begin get_filter_list begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0x82ba928 ptr=0x82ba955 end=0x82ba99d len=72 end get_filter 0 begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0x82ba928 ptr=0x82ba978 end=0x82ba99d len=37 end get_filter 0 end get_filter_list end get_filter 0 ber_scanf fmt ({M}}) ber: ber_dump: buf=0x82ba928 ptr=0x82ba98e end=0x82ba99d len=15 ==> limits_get: conn=3 op=3 dn="[anonymous]" => bdb_search bdb_dn2entry("dc=cse,dc=yorku,dc=ca") => bdb_dn2id("dc=cse,dc=yorku,dc=ca") <= bdb_dn2id: got id=0x1 entry_decode: "dc=cse,dc=yorku,dc=ca" <= entry_decode(dc=cse,dc=yorku,dc=ca) => access_allowed: search access to "dc=cse,dc=yorku,dc=ca" "entry" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) search_candidates: base="dc=cse,dc=yorku,dc=ca" (0x00000001) scope=2 => bdb_dn2idl("dc=cse,dc=yorku,dc=ca") => bdb_filter_candidates AND => bdb_list_candidates 0xa0 => bdb_filter_candidates OR => bdb_list_candidates 0xa1 => bdb_filter_candidates EQUALITY => bdb_equality_candidates (objectClass) => key_read bdb_idl_fetch_key: [b49d1940] <= bdb_index_read: failed (-30989) <= bdb_equality_candidates: id=0, first=0, last=0 <= bdb_filter_candidates: id=0 first=0 last=0 => bdb_filter_candidates AND => bdb_list_candidates 0xa0 => bdb_filter_candidates EQUALITY => bdb_equality_candidates (objectClass) => key_read bdb_idl_fetch_key: [9bee355f] <= bdb_index_read 2 candidates <= bdb_equality_candidates: id=2, first=3, last=4 <= bdb_filter_candidates: id=2 first=3 last=4 => bdb_filter_candidates EQUALITY => bdb_equality_candidates (ou) <= bdb_equality_candidates: (ou) not indexed <= bdb_filter_candidates: id=-1 first=1 last=7 <= bdb_list_candidates: id=-1 first=3 last=4 <= bdb_filter_candidates: id=-1 first=3 last=4 <= bdb_list_candidates: id=-1 first=3 last=4 <= bdb_filter_candidates: id=-1 first=3 last=4 <= bdb_list_candidates: id=-1 first=3 last=4 <= bdb_filter_candidates: id=-1 first=3 last=4 bdb_search_candidates: id=-1 first=3 last=4 entry_decode: "ou=people,dc=cse,dc=yorku,dc=ca" <= entry_decode(ou=people,dc=cse,dc=yorku,dc=ca) => bdb_dn2id("ou=people,dc=cse,dc=yorku,dc=ca") <= bdb_dn2id: got id=0x3 => test_filter => test_filter_and => test_filter => access_allowed: search access to "ou=people,dc=cse,dc=yorku,dc=ca" "objectClass" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => test_filter => access_allowed: search access to "ou=people,dc=cse,dc=yorku,dc=ca" "ou" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 5 <= test_filter_and 5 <= test_filter 5 bdb_search: 3 does not match filter entry_decode: "ou=group,dc=cse,dc=yorku,dc=ca" <= entry_decode(ou=group,dc=cse,dc=yorku,dc=ca) => bdb_dn2id("ou=group,dc=cse,dc=yorku,dc=ca") <= bdb_dn2id: got id=0x4 => test_filter => test_filter_and => test_filter => access_allowed: search access to "ou=group,dc=cse,dc=yorku,dc=ca" "objectClass" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => test_filter => access_allowed: search access to "ou=group,dc=cse,dc=yorku,dc=ca" "ou" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 5 <= test_filter_and 5 <= test_filter 5 bdb_search: 4 does not match filter send_ldap_result: conn=3 op=3 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=4 tag=101 err=0 ber_flush2: 14 bytes to sd 15 ldap_write: want=14, written=14 daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 connection_get(15) connection_get(15): got connid=3 connection_read(15): checking for input on id=3 ber_get_next daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL ldap_read: want=8, got=8 ldap_read: want=42, got=42 ber_get_next: tag 0x30 len 48 contents: ber_dump: buf=0x82cab08 ptr=0x82cab08 end=0x82cab38 len=48 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=3 op=4 do_search ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x82cab08 ptr=0x82cab0b end=0x82cab38 len=45 >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> SRCH "" 0 0begin get_filter PRESENT ber_scanf fmt (m) ber: ber_dump: buf=0x82cab08 ptr=0x82cab1e end=0x82cab38 len=26 end get_filter 0 ber_scanf fmt ({M}}) ber: ber_dump: buf=0x82cab08 ptr=0x82cab2b end=0x82cab38 len=13 daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL => test_filter => access_allowed: search access to "" "objectClass" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => send_search_entry: conn 3 dn="" => access_allowed: read access to "" "entry" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) ber_flush2: 11 bytes to sd 15 ldap_write: want=11, written=11 <= send_search_entry: conn 3 exit. send_ldap_result: conn=3 op=4 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=5 tag=101 err=0 ber_flush2: 14 bytes to sd 15 ldap_write: want=14, written=14 daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(15) connection_get(15): got connid=3 connection_read(15): checking for input on id=3 ber_get_next ldap_read: want=8, got=7 ber_get_next: tag 0x30 len 5 contents: ber_dump: buf=0x82caea0 ptr=0x82caea0 end=0x82caea5 len=5 ber_get_next ldap_read: want=8, got=0 ber_get_next on fd 15 failed errno=0 (Success) connection_read(15): input error=-2 id=3, closing. connection_closing: readying conn=3 sd=15 for close daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_close: deferring conn=3 sd=15 conn=3 op=5 do_unbind connection_resched: attempting closing conn=3 sd=15 connection_close: conn=3 sd=15 daemon: removing 15 daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(10): daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 busy >>> slap_listener(ldaps:///) daemon: activity on 1 descriptor daemon: activity on: daemon: listen=10, new connection on 15 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: added 15r (active) listener=(nil) daemon: activity on 2 descriptors daemon: activity on: slap_listener_activate(10): daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 busy >>> slap_listener(ldaps:///) daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: listen=10, new connection on 16 daemon: activity on 1 descriptor daemon: activity on: 16r daemon: read active on 16 daemon: added 16r (active) listener=(nil) daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(16) daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(16): got connid=5 connection_read(16): checking for input on id=5 TLS trace: SSL_accept:before/accept initialization tls_read: want=11, got=11 tls_read: want=107, got=107 TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A tls_write: want=4096, written=4096 TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write server done A tls_write: want=723, written=723 TLS trace: SSL_accept:SSLv3 flush data tls_read: want=5 error=Resource temporarily unavailable TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS trace: SSL_accept:error in SSLv3 read client certificate A daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: 16r daemon: read active on 16 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(16) connection_get(16): got connid=5 connection_read(16): checking for input on id=5 tls_read: want=5, got=5 tls_read: want=134, got=134 TLS trace: SSL_accept:SSLv3 read client key exchange A tls_read: want=5, got=5 tls_read: want=1, got=1 tls_read: want=5, got=5 tls_read: want=48, got=48 TLS trace: SSL_accept:SSLv3 read finished A TLS trace: SSL_accept:SSLv3 write change cipher spec A TLS trace: SSL_accept:SSLv3 write finished A tls_write: want=59, written=59 TLS trace: SSL_accept:SSLv3 flush data connection_read(16): unable to get TLS client DN, error=49 id=5 daemon: activity on 2 descriptors daemon: activity on: 16r daemon: read active on 16 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(16) connection_get(16): got connid=5 connection_read(16): checking for input on id=5 ber_get_next tls_read: want=5, got=5 tls_read: want=32, got=32 TLS trace: SSL3 alert read:warning:close notify ldap_read: want=8, got=0 ber_get_next on fd 16 failed errno=0 (Success) connection_read(16): input error=-2 id=5, closing. connection_closing: readying conn=5 sd=16 for close connection_close: conn=5 sd=16 daemon: removing 16 tls_write: want=37, written=37 TLS trace: SSL3 alert write:warning:close notify daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(15) connection_get(15): got connid=4 connection_read(15): checking for input on id=4 TLS trace: SSL_accept:before/accept initialization tls_read: want=11, got=0 TLS: can't accept. connection_read(15): TLS accept failure error=-1 id=4, closing connection_closing: readying conn=4 sd=15 for close connection_close: conn=4 sd=15 daemon: removing 15 daemon: activity on 2 descriptors daemon: activity on: slap_listener_activate(8): daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 busy daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL >>> slap_listener(ldap:///) daemon: listen=8, new connection on 15 daemon: added 15r (active) listener=(nil) daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(8): daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 busy daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL >>> slap_listener(ldap:///) daemon: listen=8, new connection on 16 daemon: activity on 1 descriptor daemon: activity on: daemon: added 16r (active) listener=(nil) daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 2 descriptors daemon: activity on: 16r daemon: read active on 16 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(16) connection_get(16): got connid=7 connection_read(16): checking for input on id=7 ber_get_next ldap_read: want=8, got=8 ldap_read: want=94, got=94 ber_get_next: tag 0x30 len 100 contents: ber_dump: buf=0x82bd918 ptr=0x82bd918 end=0x82bd97c len=100 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=7 op=0 do_search daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x82bd918 ptr=0x82bd91b end=0x82bd97c len=97 >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> SRCH "" 0 0begin get_filter PRESENT ber_scanf fmt (m) ber: ber_dump: buf=0x82bd918 ptr=0x82bd92e end=0x82bd97c len=78 end get_filter 0 ber_scanf fmt ({M}}) ber: ber_dump: buf=0x82bd918 ptr=0x82bd93b end=0x82bd97c len=65 => test_filter => access_allowed: search access to "" "objectClass" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => send_search_entry: conn 7 dn="" => access_allowed: read access to "" "entry" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "" "namingContexts" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) ber_flush2: 54 bytes to sd 16 ldap_write: want=54, written=54 <= send_search_entry: conn 7 exit. send_ldap_result: conn=7 op=0 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=1 tag=101 err=0 ber_flush2: 14 bytes to sd 16 ldap_write: want=14, written=14 daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: 16r daemon: read active on 16 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL connection_get(15) daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(16) connection_get(16): got connid=7 connection_read(16): checking for input on id=7 ber_get_next ldap_read: want=8, got=8 ldap_read: want=50, got=50 ber_get_next: tag 0x30 len 56 contents: connection_get(15): got connid=6 ber_dump: buf=0x82bbcd8 ptr=0x82bbcd8 end=0x82bbd10 len=56 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=7 op=1 do_search ber_scanf fmt ({miiiib) ber: daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL ber_dump: buf=0x82bbcd8 ptr=0x82bbcdb end=0x82bbd10 len=53 >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> SRCH "" 0 0connection_read(15): checking for input on id=6 begin get_filter PRESENT ber_scanf fmt (m) ber: ber_dump: buf=0x82bbcd8 ptr=0x82bbcee end=0x82bbd10 len=34 end get_filter 0 ber_scanf fmt ({M}}) ber: ber_dump: buf=0x82bbcd8 ptr=0x82bbcfb end=0x82bbd10 len=21 => test_filter => access_allowed: search access to "" "objectClass" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => send_search_entry: conn 7 dn="" => access_allowed: read access to "" "entry" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "" "subschemaSubentry" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "" "subschemaSubentry" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) ber_flush2: 48 bytes to sd 16 ldap_write: want=48, written=48 <= send_search_entry: conn 7 exit. send_ldap_result: conn=7 op=1 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=2 tag=101 err=0 ber_flush2: 14 bytes to sd 16 ldap_write: want=14, written=14 daemon: activity on 1 descriptor daemon: activity on: 16r daemon: read active on 16 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(16) connection_get(16): got connid=7 connection_read(16): checking for input on id=7 ber_get_next ldap_read: want=8, got=8 ldap_read: want=71, got=71 ber_get_next: tag 0x30 len 77 contents: ber_dump: buf=0x82cb5b0 ptr=0x82cb5b0 end=0x82cb5fd len=77 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=7 op=2 do_search daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x82cb5b0 ptr=0x82cb5b3 end=0x82cb5fd len=74 >>> dnPrettyNormal: <cn=Subschema> => ldap_bv2dn(cn=Subschema,0) <= ldap_bv2dn(cn=Subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=subschema)=0 <<< dnPrettyNormal: <cn=Subschema>, <cn=subschema> SRCH "cn=Subschema" 0 0begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0x82cb5b0 ptr=0x82cb5d2 end=0x82cb5fd len=43 end get_filter 0 ber_scanf fmt ({M}}) ber: ber_get_next ber_dump: buf=0x82cb5b0 ptr=0x82cb5ec end=0x82cb5fd len=17 ldap_read: want=8, got=0 ber_get_next on fd 15 failed errno=0 (Success) connection_read(15): input error=-2 id=6, closing. connection_closing: readying conn=6 sd=15 for close daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_close: conn=6 sd=15 daemon: removing 15 => test_filter => access_allowed: search access to "cn=Subschema" "objectClass" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => send_search_entry: conn 7 dn="cn=Subschema" => access_allowed: read access to "cn=Subschema" "entry" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) => access_allowed: read access to "cn=Subschema" "objectClasses" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) ber_flush2: 16753 bytes to sd 16 ldap_write: want=16753, written=13032 ldap_write: want=3721, written=3721 <= send_search_entry: conn 7 exit. send_ldap_result: conn=7 op=2 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=3 tag=101 err=0 ber_flush2: 14 bytes to sd 16 ldap_write: want=14, written=14 daemon: activity on 1 descriptor daemon: activity on: 16r daemon: read active on 16 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(16) connection_get(16): got connid=7 connection_read(16): checking for input on id=7 ber_get_next ldap_read: want=8, got=8 ldap_read: want=111, got=111 ber_get_next: tag 0x30 len 117 contents: ber_dump: buf=0x82bedb8 ptr=0x82bedb8 end=0x82bee2d len=117 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=7 op=3 do_search ber_scanf fmt ({miiiib) ber: daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL ber_dump: buf=0x82bedb8 ptr=0x82bedbb end=0x82bee2d len=114 >>> dnPrettyNormal: <dc=cse,dc=yorku,dc=ca> => ldap_bv2dn(dc=cse,dc=yorku,dc=ca,0) <= ldap_bv2dn(dc=cse,dc=yorku,dc=ca)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=cse,dc=yorku,dc=ca)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=cse,dc=yorku,dc=ca)=0 <<< dnPrettyNormal: <dc=cse,dc=yorku,dc=ca>, <dc=cse,dc=yorku,dc=ca> SRCH "dc=cse,dc=yorku,dc=ca" 2 0begin get_filter AND begin get_filter_list begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0x82bedb8 ptr=0x82bede5 end=0x82bee2d len=72 end get_filter 0 begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0x82bedb8 ptr=0x82bee08 end=0x82bee2d len=37 end get_filter 0 end get_filter_list end get_filter 0 ber_scanf fmt ({M}}) ber: ber_dump: buf=0x82bedb8 ptr=0x82bee1e end=0x82bee2d len=15 ==> limits_get: conn=7 op=3 dn="[anonymous]" => bdb_search bdb_dn2entry("dc=cse,dc=yorku,dc=ca") => access_allowed: search access to "dc=cse,dc=yorku,dc=ca" "entry" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) search_candidates: base="dc=cse,dc=yorku,dc=ca" (0x00000001) scope=2 => bdb_dn2idl("dc=cse,dc=yorku,dc=ca") => bdb_filter_candidates AND => bdb_list_candidates 0xa0 => bdb_filter_candidates OR => bdb_list_candidates 0xa1 => bdb_filter_candidates EQUALITY => bdb_equality_candidates (objectClass) => key_read bdb_idl_fetch_key: [b49d1940] <= bdb_index_read: failed (-30989) <= bdb_equality_candidates: id=0, first=0, last=0 <= bdb_filter_candidates: id=0 first=0 last=0 => bdb_filter_candidates AND => bdb_list_candidates 0xa0 => bdb_filter_candidates EQUALITY => bdb_equality_candidates (objectClass) => key_read bdb_idl_fetch_key: [9bee355f] <= bdb_index_read 2 candidates <= bdb_equality_candidates: id=2, first=3, last=4 <= bdb_filter_candidates: id=2 first=3 last=4 => bdb_filter_candidates EQUALITY => bdb_equality_candidates (ou) <= bdb_equality_candidates: (ou) not indexed <= bdb_filter_candidates: id=-1 first=1 last=7 <= bdb_list_candidates: id=-1 first=3 last=4 <= bdb_filter_candidates: id=-1 first=3 last=4 <= bdb_list_candidates: id=-1 first=3 last=4 <= bdb_filter_candidates: id=-1 first=3 last=4 <= bdb_list_candidates: id=-1 first=3 last=4 <= bdb_filter_candidates: id=-1 first=3 last=4 bdb_search_candidates: id=-1 first=3 last=4 => test_filter => test_filter_and => test_filter => access_allowed: search access to "ou=people,dc=cse,dc=yorku,dc=ca" "objectClass" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => test_filter => access_allowed: search access to "ou=people,dc=cse,dc=yorku,dc=ca" "ou" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 5 <= test_filter_and 5 <= test_filter 5 bdb_search: 3 does not match filter => test_filter => test_filter_and => test_filter => access_allowed: search access to "ou=group,dc=cse,dc=yorku,dc=ca" "objectClass" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => test_filter => access_allowed: search access to "ou=group,dc=cse,dc=yorku,dc=ca" "ou" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 5 <= test_filter_and 5 <= test_filter 5 bdb_search: 4 does not match filter send_ldap_result: conn=7 op=3 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=4 tag=101 err=0 ber_flush2: 14 bytes to sd 16 ldap_write: want=14, written=14 daemon: activity on 1 descriptor daemon: activity on: 16r daemon: read active on 16 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(16) connection_get(16): got connid=7 connection_read(16): checking for input on id=7 ber_get_next ldap_read: want=8, got=8 ldap_read: want=42, got=42 ber_get_next: tag 0x30 len 48 contents: ber_dump: buf=0x82bbcd8 ptr=0x82bbcd8 end=0x82bbd08 len=48 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL conn=7 op=4 do_search ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x82bbcd8 ptr=0x82bbcdb end=0x82bbd08 len=45 >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> SRCH "" 0 0begin get_filter PRESENT ber_scanf fmt (m) ber: ber_dump: buf=0x82bbcd8 ptr=0x82bbcee end=0x82bbd08 len=26 end get_filter 0 ber_scanf fmt ({M}}) ber: ber_dump: buf=0x82bbcd8 ptr=0x82bbcfb end=0x82bbd08 len=13 => test_filter => access_allowed: search access to "" "objectClass" requested => slap_access_allowed: backend default search access granted to "(anonymous)" => access_allowed: search access granted by read(=rscxd) <= test_filter 6 => send_search_entry: conn 7 dn="" => access_allowed: read access to "" "entry" requested => slap_access_allowed: backend default read access granted to "(anonymous)" => access_allowed: read access granted by read(=rscxd) ber_flush2: 11 bytes to sd 16 ldap_write: want=11, written=11 <= send_search_entry: conn 7 exit. send_ldap_result: conn=7 op=4 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=5 tag=101 err=0 ber_flush2: 14 bytes to sd 16 ldap_write: want=14, written=14 daemon: activity on 1 descriptor daemon: activity on: 16r daemon: read active on 16 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(16) connection_get(16): got connid=7 connection_read(16): checking for input on id=7 ber_get_next ldap_read: want=8, got=7 ber_get_next: tag 0x30 len 5 contents: ber_dump: buf=0x82cac98 ptr=0x82cac98 end=0x82cac9d len=5 ber_get_next ldap_read: want=8, got=0 ber_get_next on fd 16 failed errno=0 (Success) connection_read(16): input error=-2 id=7, closing. connection_closing: readying conn=7 sd=16 for close connection_close: deferring conn=7 sd=16 conn=7 op=5 do_unbind connection_resched: attempting closing conn=7 sd=16 connection_close: conn=7 sd=16 daemon: removing 16 daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: shutdown requested and initiated. daemon: closing 7 daemon: closing 8 daemon: closing 9 daemon: closing 10

1 0

schema in openldap
by Aravind Arjunan 18 Jun '08

18 Jun '08

This is my newely created schema file in my ldap server for adding the attributes. But when i try to restart the ldap service i got the below error, [root@master schema]# service ldap restart Stopping slapd: [FAILED] Checking configuration files for slapd: /etc/openldap/schema/sample.schema: lin e 3: Missing closing parenthesis before AttributeTypeDescription = "(" whsp numericoid whsp ; AttributeType identifier [ "NAME" qdescrs ] ; name used in AttributeType [ "DESC" qdstring ] ; description [ "OBSOLETE" whsp ] [ "SUP" woid ] ; derived from this other ; AttributeType [ "EQUALITY" woid ] ; Matching Rule name [ "ORDERING" woid ] ; Matching Rule name [ "SUBSTR" woid ] ; Matching Rule name [ "SYNTAX" whsp noidlen whsp ] ; see section 4.3 [ "SINGLE-VALUE" whsp ] ; default multi-valued [ "COLLECTIVE" whsp ] ; default not collective [ "NO-USER-MODIFICATION" whsp ]; default user modifiable [ "USAGE" whsp AttributeUsage ]; default userApplications ; userApplications ; directoryOperation ; distributedOperation ; dSAOperation whsp ")" slaptest: bad configuration file! [FAILED] # New attribute definitions: attributetype ( 1.3.6.1.4.1.4203.666.1.90 NAME 'E-mail address' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} ) attributetype ( 1.3.6.1.4.1.4203.666.1.91 NAME 'Firstname' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} ) attributetype ( 1.3.6.1.4.1.4203.666.1.92 NAME 'Last name' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} ) attributetype ( 1.3.6.1.4.1.4203.666.1.93 NAME 'Nickname' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} ) attributetype ( 1.3.6.1.4.1.4203.666.1.94 NAME 'Additional info' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} ) objectClass ( 1.3.6.1.4.1.4203.666.1.100 NAME 'YoLinuxPerson' DESC 'X-Person' SUP inetOrgPerson STRUCTURAL MAY ( E-mail address $ First name $ Last name $ Nickname $ Additional info ) )

4 3

OpenLDAP and HP iLO
by "Maurice Völkel" 18 Jun '08

18 Jun '08

Hello together, Since a couple of weeks, I tried to connect an OpenLDAP server with an iLO board, for an central authentication system. The LDAP server Runs with Open SuSe 10.3 on OpenLDAP 2.3.37 and is configured with PAM, so that a user registration works. My problem is the configuration of the directory settings of iLO. I try to describe my config of the LDAP Server and the problem which I have with the config. In /etc/openldap/slap.conf, I included a schema called ilo.schema. The ilo.schema looks like: attributetype (1.3.6.1.4.1.15959.9.1.1 NAME 'memberOf' DESC 'Group which user belongs to' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12) objectclass (1.3.6.1.4.1.15959.9.2.1 NAME 'memberOf' SUP top AUXILIARY DESC 'Required by Integrated Lights-Out for OpenLDAP' MUST (memberOf)) objectclass (1.3.6.1.4.1.15959.9.2.2 NAME 'user' SUP top AUXILIARY DESC 'Required by Integrated Lights-Out for OpenLDAP') A test user for the iLO, added on the LDAP like the following schema: # Max, my-domain.de dn: uid = max, ou = Mitarbeiter, ou = users, dc = my-domain, dc = de cn: Max Doe givenName: Max SN: Foo gidNumber: 100 UID: Max uidNumber: 1003 userPassword: SSHA) (passwortmax homeDirectory: / home / max loginShell: / bin / bash Street: postalCode: l: ST: mail: max.mustermann(a)my-domain.de telephoneNumber: +49 shadowExpire: 14152 shadowInactive: 10 shadowLastChange: 14042 shadowMax: 14 shadowMin: 1 shadowWarning: 10 memberOf: cn = iloadmin, ou = groups, dc = my-domain, dc = de description: iLO users Max Mustermann objectClass: shadowAccount objectClass: person objectClass: inetOrgPerson objectClass: posixAccount objectClass: organizationalPerson objectClass: memberOf objectClass: user objectClass: top the cn = iloadmin, ou = groups, dc = my-domain, dc = de look like: dn: cn = iloadmin, ou = groups, dc = my-domain, dc = de cn: iloadmin objectClass: top objectClass: groupOfNames member: cn = Max Mustermann, ou = Mitarbeiter, ou = users, dc = my-domain, dc = de The settings I config on iLO web interface as follows: Under Administration -> Directory Settings -> Use Directory DefaultSchema: running Directory Server Address: my-domain.de [or IP] Directory Server LDAP Port: 636 Directory User Context 1: ou = Mitarbeiter, ou = users, dc = my-domain, dc = de And under Administration Groups -> Select a group: Administrator -> View / Modify Security Group Distinguished Name: cn = iloadmin, ou = groups, dc = my-domain, dc = de Administer Group and Accounts, Console Remote Access, Virtual Power and Reset, Virtual Media undConfigure iLO settings are enabled. If I had a test run, I get the following message: Overall status: Problem Detected Description Test status Ping Directory Server Passed Directory Server IP Address Not run Directory Server DNS name Passed Connect to Directory Server Passed Connect using SSL Passed Certificate of Directory Server Passed Bind to Directory Server Not run Directory administrator login Not Run User Authentication Failed User Authorization Not Run Directory User Context 1 Not run Directory User Not run Context 2 Directory User Context 3 Not run LOM exists Object Not Run LOM Word Object Not Run Sign Test Initiating diagnostic Directory settings for server my-domain.de Directory Server address my-domain.de resolved to IP address Accepting certificate for Directory Server / C = DE / ST = [state]/ O = [company] / OU = ldapserver / CN = meine-domain.de/EMAIL ca(a)meine-domain.de signed by / C = DE / ST = [state] / L = [place] / O = [company] / OU = [Department] / CN = [person] / EMAIL = ca(a)meine-domain.de Warning: certificate does not match my Address Directory Server-domain.de. Unable to authenticate user test max [Invalid credentials] Ceasing tests. Some diagnostics for server FAILED my-domain.de Complete tests. I read a lot of threads, but nothing could help me to find a mistake. I hope someone could help me to find the mistake. kind regards SysNewbie -- Psssst! Schon vom neuen GMX MultiMessenger gehört? Der kann`s mit allen: http://www.gmx.net/de/go/multimessenger

1 0

Re: schema in openldap
by Buchan Milne 18 Jun '08

18 Jun '08

On Wednesday 18 June 2008 12:38:10 Aravind Arjunan wrote: > I like to know whether it is possible to create our own schema and add our > own attributes and objectclass for that or not? It is possible. But, in my opinion, it is not yet necessary for your requirements. If you want to waste your time learning schema design instead of the LDAP basics, that might solve your problem, that's your decision (but I'm not going to waste my time). > If it is possible send me an example file so that i would be very thankfull > to you. > Since am trying to create my own schema and try to add attributes in > that.But when i try to restart the ldap service i got the below error. > > Checking configuration files for slapd: /etc/openldap/schema/att.schema: > line 3: AttributeType SYNTAX or SUPerior required: > "1.3.6.1.4.1.4203.666.1.100.121" > slaptest: bad configuration file! > [FAILED] > please help me with this issue. You didn't supply att.schema, but it seems that your schema definition for your OID 1.3.6.1.4.1.4203.666.1.100.121 does not include the SYNTAX or SUP keywords, one of them is required. And, you really shouldn't be using the OpenLDAP Foundations' OID arc ... Regards, Buchan

1 0

Re: schema in openldap
by Buchan Milne 18 Jun '08

18 Jun '08

On Wednesday 18 June 2008 12:34:40 Aravind Arjunan wrote: > Ok i had add entries like what you said, but when i try synchronize the > ldap address book in squirrel mail its saying no such object in ldap. > This could merely be a configuration issue. How did you determine what the exact problem was? Did you see what search squirrelmail was doing? And why it failed? Regards, Buchan

1 0

Fwd: schema in openldap
by Aravind Arjunan 18 Jun '08

18 Jun '08

---------- Forwarded message ---------- From: Aravind Arjunan <aravind.arjunan(a)gmail.com> Date: 18 Jun 2008 16:08 Subject: Re: schema in openldap To: Buchan Milne <bgmilne(a)staff.telkomsa.net> I like to know whether it is possible to create our own schema and add our own attributes and objectclass for that or not? If it is possible send me an example file so that i would be very thankfull to you. Since am trying to create my own schema and try to add attributes in that.But when i try to restart the ldap service i got the below error. Checking configuration files for slapd: /etc/openldap/schema/att.schema: line 3: AttributeType SYNTAX or SUPerior required: "1.3.6.1.4.1.4203.666.1.100.121" slaptest: bad configuration file! [FAILED] please help me with this issue. On 18/06/2008, Aravind Arjunan <aravind.arjunan(a)gmail.com> wrote: > > Ok i had add entries like what you said, but when i try synchronize the > ldap address book in squirrel mail its saying no such object in ldap. > > On 18/06/2008, Buchan Milne <bgmilne(a)staff.telkomsa.net> wrote: >> >> On Wednesday 18 June 2008 10:33:47 Aravind Arjunan wrote: >> > This is my newely created schema file in my ldap server for adding the >> > attributes. >> >> Why are you making your life difficult? Just add entries like this: >> >> >> dn: cn=Saju Kuttan,ou=solution,dc=test,dc=com >> objectClass: inetOrgPerson >> cn: Saju Kuttan >> sn: Kuttan >> givenName: Saju >> description: Saju Kuttan in the Oracle team >> telephoneNumber: 9891950975 >> mail: csaju(a)hcl.in >> >> >> There doesn't seem to be an attribute for the Nick Name field in Outlook, >> see: >> http://www.openldap.org/faq/data/cache/294.html >> >> >> Regards, >> Buchan >> >> >

1 0

Re: Openldap fine grained / advanced ACLs
by Faraz R. Khan 18 Jun '08

18 Jun '08

So basically I can do: to * by cn=admin,dc=company,dc=com add by cn=faraz,dc=company,dc=com zap That is indeed not documented anywhere. Will start an ITS Pierangelo Masarati wrote: > Faraz R. Khan wrote: >> Is it possible to have fine grained ACLs in OpenLDAP? My problem is >> that the 'write' access is too broad. I wish to be able to control >> ADD, modify and delete separately. I tried looking at >> aacls.sourceforge.net but it involves the setup of a separate server >> and looks abandoned. >> >> Any pointers would be appreciated- maybe the denyop module? I was >> trying to find some docs but all I could find was a FAQ entry. > > OpenLDAP 2.4 allows to split the write privilege into "a" (add) and "z" > (zap). A separate privilege for "modify" does not make too much sense > to me: if a value is added, then one just needs "add"; if a (set of) > value(s) is replaced, then one needs both "zap" (to delete old values) > and "add" (to add new ones), and thus "write" is just fine. On a > related note, I just realized this is not documented anywhere but in the > mailing list. I suggest you file an ITS <http://ww.openldap.org/its/> > to request a documentation update. > > p. > > > Ing. Pierangelo Masarati > OpenLDAP Core Team > > SysNet s.r.l. > via Dossi, 8 - 27100 Pavia - ITALIA > http://www.sys-net.it > ----------------------------------- > Office: +39 02 23998309 > Mobile: +39 333 4963172 > Email: ando(a)sys-net.it > ----------------------------------- > > -- Faraz R Khan Chief Architect Emergen Consulting Pvt Ltd +92.21.529.0381 x200 www.emergen.biz

2 1

Re: openldap
by Aravind Arjunan 18 Jun '08

18 Jun '08

hi buchan, These are the schema files in my server. include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema And i need to add the following attribute, 1)mail id or E-mail address 2)mailbox location 3)First name 4)Last name 5)Additional info 6)Nickname ( this is for squirrelmail address book syncronization with ldap database) On 17/06/2008, Michael Ströder <michael(a)stroeder.com> wrote: > > Aravind Arjunan wrote: > >> ldap_modify: Cannot modify object class (69) >> additional info: structural object class modification from 'person' >> to ' >> inetOrgPerson' not allowed >> > > You cannot change a structural object class. 'person' and 'inetOrgPerson' > are both structural object classes with the latter derived from the former. > In this case you have to delete and re-add the entries. > > See also: > http://www.openldap.org/faq/data/cache/1341.html > > Ciao, Michael. >

1 0

meta config help
by danz＠wustl.edu 17 Jun '08

17 Jun '08

We are attempting to setup a configuration that would allow us to bind/search 2 different back-ends with 2 completely different suffixes. Below is our configuration and the error we get back. We are able to connect to both back-ends provided the other is commented out in the slapd.conf file so we are sure the suffix change works for both targets. [slapd.conf] database meta suffix "dc=virtual" lastmod off #rebind-as-user uri "ldap://foo.wuaddev.wustl.edu/dc=virtual" suffixmassage "dc=virtual" "ou=Users,ou=Persons,dc=wuaddev,dc=wustl,dc=edu" #uri "ldap://bar.wustl.edu/dc=virtual" #suffixmassage "dc=virtual" "OU=users,OU=ais" [search command] -bash-3.00# ldapsearch -h localhost -v -b 'dc=virtual' -s sub -D 'cn=ssbinduser,dc=virtual' -w 'foobar' 'cn=ssbinduser' ldapsearch: started Tue Jun 17 13:28:59 2008 ldap_init( localhost, 389 ) ldap_simple_bind: Operations error [Debug output of /usr/local/libexec/slapd] Ldap Err: DSID-0C0906 2B, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece. This error comes from the remote LDAP server not accepting the bind request successfully. Your insight is greatly appreciated. Regards, Dan

1 0

Re: Openldap fine grained / advanced ACLs
by Raphaël Ouazana-Sustowski 17 Jun '08

17 Jun '08

Hi, Le Mar 17 juin 2008 16:30, Faraz R. Khan a écrit : > Is it possible to have fine grained ACLs in OpenLDAP? My problem is that > the 'write' access is too broad. I wish to be able to control ADD, > modify and delete separately. I tried looking at aacls.sourceforge.net > but it involves the setup of a separate server and looks abandoned. Just a note: this project has not been abandoned. In fact the "set" functionality of OpenLDAP now supersedes AACLs: http://www.openldap.org/faq/data/cache/1133.html Regards, Raphaël Ouazana.

1 0

Openldap fine grained / advanced ACLs
by Faraz R. Khan 17 Jun '08

17 Jun '08

Is it possible to have fine grained ACLs in OpenLDAP? My problem is that the 'write' access is too broad. I wish to be able to control ADD, modify and delete separately. I tried looking at aacls.sourceforge.net but it involves the setup of a separate server and looks abandoned. Any pointers would be appreciated- maybe the denyop module? I was trying to find some docs but all I could find was a FAQ entry. Any pointers would be welcome. Thank you. -- Faraz R Khan Chief Architect Emergen Consulting Pvt Ltd +92.21.529.0381 x200 www.emergen.biz

2 1

Re: Fwd: openldap
by Aravind Arjunan 17 Jun '08

17 Jun '08

Ya i had tried through schema, in internet. It was mentioned tat we can create our own schema for eg: test.schema and we can add the list off attributes that are required for us. I have tried that also but it was not working. I will tell the objective of mine. we have mailserver in RHEL 5 and ldap server is separate. we have all the user information in ldap server including mail id mail box location and other things related to mail and organization. so when a user sends mail the information must want to fetched from ldap server and work accordingly. somehow please help with this issue.Since i need some help from you guys. And thanks in advance. On 17/06/2008, Buchan Milne <bgmilne(a)staff.telkomsa.net> wrote: > > On Tuesday 17 June 2008 14:55:34 Aravind Arjunan wrote: > > Its working when i do it intially. > > can you please tell wat objectclass i have to add when i add the below > > attributes. > > > > 1)Nickname: > > 2)E-mail address: > > 3)First name: > > 4)Last name: > > 5)Additional info: > > These aren't attributes. You haven't specified the client, so it is > difficult > to guess what attributes the client is going to map to these address book > fields. > > However, if I were to guess, they would be: > > 1)displayName (from officeperson.schema) > 2)mail > 3)gn > 4)sn > 5)N/A > > 2-4 are all supported with inetOrgPerson. > > However, this is the kind of information you can determine for yourself. > Please consult the schema definitions ... > > Regards, > Buchan >

2 1

Fwd: Fwd: openldap
by Aravind Arjunan 17 Jun '08

17 Jun '08

---------- Forwarded message ---------- From: Aravind Arjunan <aravind.arjunan(a)gmail.com> Date: 17 Jun 2008 18:25 Subject: Re: Fwd: openldap To: Buchan Milne <bgmilne(a)staff.telkomsa.net> Its working when i do it intially. can you please tell wat objectclass i have to add when i add the below attributes. 1)Nickname: 2)E-mail address: 3)First name: 4)Last name: 5)Additional info: On 17/06/2008, Buchan Milne <bgmilne(a)staff.telkomsa.net> wrote: > > On Tuesday 17 June 2008 14:22:59 Aravind Arjunan wrote: > > ---------- Forwarded message ---------- > > From: Aravind Arjunan <aravind.arjunan(a)gmail.com> > > Date: 17 Jun 2008 17:52 > > Subject: Re: openldap > > To: Michael Ströder <michael(a)stroeder.com> > > > > This is my ldif file, here i have used objectclass as person > > Objectclass person does not include the mail attribute. The objectclass > inetOrgPerson, which you have commented out, does. > > > and i have > > included attribute mail and i got the error. > > > > I had tested by adding objectClass as inetOrgPerson and i got the below > > error. > > > > ldap_modify: Cannot modify object class (69) > > additional info: structural object class modification from > 'person' > > to ' > > inetOrgPerson' not allowed > > Create the entry with the objectclass inetOrgPerson initially ... > > > # Oracle Team > > > > dn: cn=saju,ou=solution,dc=test,dc=com > > objectClass: person > > #objectClass: inetOrgPerson > > cn: saju > > sn: kuttan > > description: Oracle team > > telephoneNumber: 9891950975 > > mail: csaju(a)hcl.in > > > Regards, > Buchan >

1 0

Fwd: openldap
by Aravind Arjunan 17 Jun '08

17 Jun '08

---------- Forwarded message ---------- From: Aravind Arjunan <aravind.arjunan(a)gmail.com> Date: 17 Jun 2008 17:52 Subject: Re: openldap To: Michael Ströder <michael(a)stroeder.com> This is my ldif file, here i have used objectclass as person and i have included attribute mail and i got the error. I had tested by adding objectClass as inetOrgPerson and i got the below error. ldap_modify: Cannot modify object class (69) additional info: structural object class modification from 'person' to ' inetOrgPerson' not allowed # Oracle Team dn: cn=saju,ou=solution,dc=test,dc=com objectClass: person #objectClass: inetOrgPerson cn: saju sn: kuttan description: Oracle team telephoneNumber: 9891950975 mail: csaju(a)hcl.in dn: cn=aravind,ou=solution,dc=test,dc=com objectClass: person #objectClass: inetOrgPerson cn: aravind sn: arjunan description: Oracle team mail: aaravind(a)hcl.in #mobilenumber: 9899798985 # Microsoft Team dn: cn=Kannan,ou=solution,dc=test,dc=com objectClass: person #objectClass: inetOrgPerson cn: Kannan sn: Kann description: Microsoft Team mail: kannans(a)hcl.in #mobilenumber: 9891200471 dn: cn=Manish,ou=solution,dc=test,dc=com objectClass: person cn: Manish sn: Gupta description: Microsoft Team telephoneNumber: 9818206547 dn: cn=sachin,ou=solution,dc=test,dc=com objectClass: person cn: sachin sn: saghal description: Microsoft Team telephoneNumber: 9873574433 On 17/06/2008, Michael Ströder <michael(a)stroeder.com> wrote: > > Aravind Arjunan wrote: > >> ldap_add: Object class violation (65) >> additional info: attribute 'mail' not allowed >> What i need to do for adding this attribute. tell me the correct >> objectclass for this attribute. >> > > Most people use object class 'inetOrgPerson' for adding attribute 'mail' to > user/person entries. Since you don't provide an example entry nobody can > tell what's right for your data. > > Ciao, Michael. >

2 1

openldap
by Aravind Arjunan 17 Jun '08

17 Jun '08

Hi, I had configured openldap 2.3.27-5 in RHEL 5 operating systems. my ldap is acting as a master slave. I have no problem with that, the changes what i make in master is getting replicated to slave. What i need to know is, I had to certain attributes to my openldap server. for eg: when i add an attribute called ' mail ' for specifying mail address and in the ldif file and if i add that ldif file using 'ldapadd' command am getting, ldap_add: Object class violation (65) additional info: attribute 'mail' not allowed What i need to do for adding this attribute. tell me the correct objectclass for this attribute.

1 0

syncrepl in OpenLDAP 2.3.x and updating on a replica
by Filipe Brandenburger 17 Jun '08

17 Jun '08

Hi, I have a setup with two CentOS 5 machines running OpenLDAP 2.3.x, right now the primary uses slurpd to send the updates to the second server, and the second server is using "updatedn" to allow updates (from what I understand! I'm no OpenLDAP guru here.) Clients are using pam_ldap and nss_ldap to get the users and authenticate them in LDAP. Right now hosts query only the primary LDAP server, that is the address set on the "host" variable of /etc/ldap.conf. Changing password with "passwd" works fine, and the password is correctly replicated to the secondary server. Now, first thing, I wanted to load balance between the two servers. The way I did it was to register a Round-Robin DNS record, with one A entry for each server IP, and I used that entry in the "host" variable of /etc/ldap.conf. Everything worked. Queries going each time to a different server. I was expecting to have problems changing passwords, but amazingly it worked. Apparently when a password change request goes to the second server, that server will do a query on the first server to do the password change, and then (through slurpd) the change gets replicated on the second one. Everything great. (Is there a better configuration for pam_ldap and nss_ldap on /etc/ldap.conf for load balancing other than round-robin DNS?) Now, I was reading that syncrepl is superior to slurpd, and that syncrepl is the preferred method of replication. I actually saw that it's true when I saw that it actually replicated the master without having to stop it and copy the dbs (which is necessary with slurpd.) I even saw that in OpenLDAP 2.4.x slurpd is deprecated/discontinued and only syncrepl is supported. So I'm trying to migrate from slurpd to syncrepl. And so far everything is working fine in my test environments. This is what I have configured on the master: overlay syncprov syncprov-checkpoint 1 10 syncprov-sessionlog 100 And on the slave: syncrepl rid=1 provider=ldap://ldap1.mydomain.com type=refreshAndPersist searchbase="dc=mydomain,dc=com" schemachecking=off bindmethod=simple binddn="cn=Manager,dc=mydomain,dc=com" credentials=xxxxxxxxxxx updateref ldap://ldap1.mydomain.com/ It works with queries, and when I do an update on the master, it replicates fine to the slave. But when I try to do some change on the slave, that's what I get: $ ldapdelete -H ldap://ldap2.mydomain.com/ -D cn=Manager,dc=mydomain,dc=com \ -w XXXXXXX -x uid=usertodelete,ou=Users,dc=mydomain,dc=com ldap_delete: Referral (10) referrals: ldap://ldap1.mydomain.com/uid=usertodelete,ou=Users,dc=mydomain,dc=com I would like to have something closer to what happens when using slurpd, which seems to be more transparent to clients. I tried to set "updatedn" but slapd complained that it is supported when using slurpd. I also tried to start configuring overlay on the slave and syncrepl on the master, but when I do that I can't run updates on either side, both of them end up being read-only. I read that on OpenLDAP 2.4.x Administration Guide, on the section about multi-master replication, but I then saw that multi-master replication is supposed to work only on 2.4.x, and not on 2.3.x, so that's apparently not an option. So I ask: is there a way to configure OpenLDAP so that the slave (running syncrepl) can send updates to the master when receives from a client? Or (not as good but still an option): If I use "updateref" to send Referral, how can I make sure the tools (ldapdelete, ldapmodify, ldapadd, ...) actually *follow* the referral (I looked for that in man pages and didn't find any obvious options for that)? And more important, will pam_ldap and nss_ldap follow those referrals when changing the password? Do I have to set something on /etc/ldap.conf for that? Upgrade to 2.4.x is something I would like to avoid, since I would rather stick with what is supported by CentOS 5. Sorry for the long e-mail! Any help and advices will be appreciated. Thanks a lot! Filipe

4 7

Re: [Samba] ldap filter removed? - Solution
by Jarbas Peixoto Júnior 16 Jun '08

16 Jun '08

Can anybody help me about that? []s Jarbas Remy Zandwijk escreveu: > Hi Jarbas, > > Nice solution, but how do you handle ldap searches from different Samba domains? I mean, all searches will use the same filter, which will be converted to another filter. Is OpenLDAP capable of 'rewrite when search from IP number x.x.x.x' ? > > Remy > > > >> In reference at http://lists.samba.org/archive/samba/2005-August/108999.html and http://threebit.net/mail-archive/samba/msg00118.html >> >> Hi Remy, >> Hi Norbert, >> >> >> I have the similar problem e I resolved with the "overlay rwm in openldap". >> >> If in smb.conf I haved: ldap filter = (&(iufmLogin=%u)(gecos=#*)) >> >> When the new samba search by any user, the following filter in openldap is used: (&(uid=user)(objectClass=sambaSamAccount)). Then the overlay replace by filter by (&(iufmLogin=$1)(gecos=#*)) only in openldap server. >> >> My slapd.conf (only the part with overlay rwm) is: >> ... >> moduleload rwm >> overlay rwm >> rwm-rewriteEngine on >> rwm-rewriteContext searchFilter >> rwm-rewriteRule "\$&\\(uid=([a-z0-9_]+)\$\$objectClass=sambaSamAccount\$\\)" "(&(iufmLogin=$1)(objectClass=sambaSamAccount))" ":@I" >> ... >> >> This work fine to me. >> >> >

1 0

Thunderbird & OpenLDAP
by Erik Lotspeich 16 Jun '08

16 Jun '08

Hi, Is there anyone who is using Thunderbird and OpenLDAP with SSL enabled? I cannot get this combination to work -- I can only use Thunderbird with non-SSL OpenLDAP. If no one can say, definitively, that this works, I guess there must be a bug in one or both software packages. Any help would be greatly appreciated. Thanks, Erik.

2 1

slapd-passwd backend problems
by Lawrence Stewart 16 Jun '08

16 Jun '08

Hi all, I'm attempting to set up a very simple passwd database backed slapd instance and can't seem to make it work reliably. A number of hours on google and experimenting with options has not been fruitful so far. I'm running openldap 2.4.10 on FreeBSD 7.0 My slapd.conf looks like this: ############################################## include /usr/local/etc/openldap/schema/core.schema loglevel conns filter stats pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/local/libexec/openldap moduleload back_passwd moduleload back_monitor access to * by anonymous read database passwd readonly yes suffix "dc=example,dc=com" rootdn "cn=root,dc=example,dc=com" rootpw <passwod> database monitor ############################################## I am able to successfully start slapd and I can successfully query for a user by running the following command on the server itself: ldapsearch -x -H ldap://127.0.0.1 -b 'dc=example,dc=com' 'uid=test' which correctly returns the following details about the test user already in the system's passwd database: ############################################## # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: uid=test # requesting: ALL # # test, example.com dn: uid=test,dc=example,dc=com objectClass: person objectClass: uidObject uid: test cn: test cn: Testy McTest sn: test sn: McTest description: Testy McTest # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 ############################################## However, attempting an identical, additional query after the first one results in an empty search being returned: ############################################## # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: uid=test # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 ############################################## I have experimented with many different options in slapd.conf and have not found anything that is able to mitigate this behaviour. The only way I have found to make an additional query work successfully is to restart slapd. After a restart, I can successfully make a single query again and then it stops returning a query result. The debugging output from slapd when a query is successful looks like this: ############################################## Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: waked Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: listen=7, new connection on 8 Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: added 8r (active) listener=0x0 Jun 16 13:19:29 newtcp8 slapd[11410]: conn=0 fd=8 ACCEPT from IP=127.0.0.1:59836 (IP=0.0.0.0:389) Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: waked Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: activity on: Jun 16 13:19:29 newtcp8 slapd[11410]: 8r Jun 16 13:19:29 newtcp8 slapd[11410]: Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: read activity on 8 Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: waked Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: conn=0 op=0 BIND dn="" method=128 Jun 16 13:19:29 newtcp8 slapd[11410]: conn=0 op=0 RESULT tag=97 err=0 text= Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: activity on: Jun 16 13:19:29 newtcp8 slapd[11410]: 8r Jun 16 13:19:29 newtcp8 slapd[11410]: Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: read activity on 8 Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: waked Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: begin get_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: end get_filter 0 Jun 16 13:19:29 newtcp8 slapd[11410]: conn=0 op=1 SRCH base="dc=example,dc=com" scope=2 deref=0 filter="(uid=test)" Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:19:29 newtcp8 slapd[11410]: => test_filter Jun 16 13:19:29 newtcp8 slapd[11410]: EQUALITY Jun 16 13:19:29 newtcp8 slapd[11410]: <= test_filter 6 Jun 16 13:19:29 newtcp8 slapd[11410]: conn=0 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: activity on: Jun 16 13:19:29 newtcp8 slapd[11410]: 8r Jun 16 13:19:29 newtcp8 slapd[11410]: Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: read activity on 8 Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: connection_read(8): input error=-2 id=0, closing. Jun 16 13:19:29 newtcp8 slapd[11410]: conn=0 op=2 UNBIND Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: removing 8 Jun 16 13:19:29 newtcp8 slapd[11410]: conn=0 fd=8 closed Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: waked Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:19:29 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL ############################################## and for an unsuccessful query looks like this: ############################################## Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=7 busy Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: listen=7, new connection on 8 Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: added 8r (active) listener=0x0 Jun 16 13:22:21 newtcp8 slapd[11410]: conn=1 fd=8 ACCEPT from IP=127.0.0.1:64362 (IP=0.0.0.0:389) Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: waked Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: activity on: Jun 16 13:22:21 newtcp8 slapd[11410]: 8r Jun 16 13:22:21 newtcp8 slapd[11410]: Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: read activity on 8 Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: conn=1 op=0 BIND dn="" method=128 Jun 16 13:22:21 newtcp8 slapd[11410]: conn=1 op=0 RESULT tag=97 err=0 text= Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: waked Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: activity on: Jun 16 13:22:21 newtcp8 slapd[11410]: 8r Jun 16 13:22:21 newtcp8 slapd[11410]: Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: read activity on 8 Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: begin get_filter Jun 16 13:22:21 newtcp8 slapd[11410]: EQUALITY Jun 16 13:22:21 newtcp8 slapd[11410]: end get_filter 0 Jun 16 13:22:21 newtcp8 slapd[11410]: conn=1 op=1 SRCH base="dc=example,dc=com" scope=2 deref=0 filter="(uid=test)" Jun 16 13:22:21 newtcp8 slapd[11410]: => test_filter Jun 16 13:22:21 newtcp8 slapd[11410]: EQUALITY Jun 16 13:22:21 newtcp8 slapd[11410]: <= test_filter 5 Jun 16 13:22:21 newtcp8 slapd[11410]: conn=1 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: waked Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: activity on: Jun 16 13:22:21 newtcp8 slapd[11410]: 8r Jun 16 13:22:21 newtcp8 slapd[11410]: Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: read activity on 8 Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: connection_read(8): input error=-2 id=1, closing. Jun 16 13:22:21 newtcp8 slapd[11410]: conn=1 op=2 UNBIND Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: removing 8 Jun 16 13:22:21 newtcp8 slapd[11410]: conn=1 fd=8 closed Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: activity on 1 descriptor Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: waked Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=6 active_threads=0 tvp=NULL Jun 16 13:22:21 newtcp8 slapd[11410]: daemon: select: listen=7 active_threads=0 tvp=NULL ############################################## I have analysed both sets of debug output and there are no material differences except that the successful query applies a number of equality test operations (indicating it is successfully walking through the entries in the passwd file) where as the failed query only applies 1 equality test. It's like the subsequent queries are not causing a full re-walk of the passwd database to find a match, but that's pure speculation at this point. Any insights into why the passwd backend might be behaving like this would be greatly appreciated. Please let me know if additional information or more detailed debugging output would help to diagnose the issue. Thanks in advance. Cheers, Lawrence

1 0

LDAP ACL/ ADRESSBOOK Problems and more
by Sebastian Reinhardt 15 Jun '08

15 Jun '08

Hi, I have some huge (for me, but I hope not for the experts in this list) problems: First the server config: - openSuSE 10.3 (x86_64) - openldap openldap2-2.3.37-7.4 User administration, NFS and also Apache (for company intern information websites, not for "real" web) is running without problems and 5 clients (openSuSE 10.3 (x86_64 and i586), too), replication is not setup yet, but this is not the major problem. 1. Problem: I added an central adressbook into the ldap- directory. It can be edited by KAdressBook and also used by Thunderbird from every Client, but for editing the ldap-root- Login is required (no good idea, I know and I like to change) and everyone can read the hole ldap- directory (have to be changed, too). I tried to give only users of group "adressbook_write" permission to edit entries in "ou=people"- part (adressbook) of ldap and users of "adressbook_read"- group the "read"- rights. Any other should not be allowed to read or write in "ou=people" or other parts of the ldap directory. This is the section of slap.conf: ---------------------------------- access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to attrs=userPassword,userPKCS12 by self write by * auth access to attrs=shadowLastChange by self write by * read access to dn.base="ou=people,dc=LMV,dc=LMV" by group="cn=adressbook_read,dc=LMV,dc=LMV" read by group="cn=adressbook_write,dc=LMV,dc=LMV" write access to * by * read ----------------------------------------- I tried it also without "dn.base=" in front of first line (access to..), but then user- auth. was disabled. What is wrong? Can I delete "access to * by * read", without disabling Login- capability ? 2. Problem: KAddressBook can access (r/w, only by using root- access, simple auth.) the ldap- address book (ou=people). Reading is no problem, but by saving an new entry, KAddressBook shows the busy- symbol (mouse symbol) an the new entry is not shown in KAddressBook, but the entry is saved in ldap (it can be read/ edited by other applications; ldapbrowser or other). Whats the problem? KAddressBook, user read/write permissions? Or is it LDAP? To show the new entry in KAddressBook, the program has to be restarted. But KAddressBook is not crashed or frozen, the user can add new address or show/ edit old entries. 3. Problem: Is any schema available, which can handle more (3 or more) email- addresses for every entry? I can not figure out, if the mozilla- schema ( german HowTo and schema taken from: http://www.pro-linux.de/t_office/openldap-adressbuch.html ) can handle more than one email- entry per person. Is this possible or is Thunderbird unable to read more than one email address from ldap? And if so, how can store all addresses from KAdressBook in LDAP (to share it with other KAddressBook- Clients)? 4. Auto- LogIn Some Clients where used only by one person/ login. With local user management, openSuSE provides the option to login an standard user at boot. Is an automatic user login with ldap-users and ldap- user management possible? 5. file/ dir- modes Is it possible to change the default file- mode (644) and dir- mode (755) in ldap user accounts for new generated files into file: 660 and dir: 770 ? So the group- members can edit files/ dirs generated by other users of same ldap managed group ? Thanks -- Mit freundlichen Grüßen Sebastian Reinhardt

1 0

help with ldapsearch on uid
by joshua＠itsecureadmin.com 13 Jun '08

13 Jun '08

Hello, I am using OpenLDAP 2.4.9 on CentOS 5.1 (32 bit) with a custom schema and I have added ~7500 objects and I am not able to search successfully for these objects by uid. What must I do to be able to search for these objects by uid? Sample object: # 496user, People, example.com dn: uid=496user,ou=People,dc=example,dc=com objectClass: mailAccount maildrop: 496user(a)nest.tld mailid: 496user(a)nest.tld maildir: 496user/ userPassword:: secret mailquota: 35969216S If I search for this user by uid, I will get no results back: # ldapsearch -xZZ -b "ou=people,dc=example,dc=com" uid=496user # extended LDIF # # LDAPv3 # base <ou=people,dc=example,dc=com> with scope subtree # filter: uid=496user # requesting: ALL # # search result search: 3 result: 0 Success # numResponses: 1 Searching by mailid does work: # ldapsearch -xZZ -b "ou=people,dc=example,dc=com" mailid=496user(a)nest.tld ...<snip>... dn: uid=496user,ou=People,dc=example,dc=com objectClass: mailAccount maildrop: 496user(a)nest.tld mailid: 496user(a)nest.tld maildir: 496user/ userPassword:: secret mailquota: 35969216S # search result search: 3 result: 0 Success # numResponses: 2 # numEntries: 1 The schema is as follows (downloaded from riseuplabs.org): objectIdentifier OID 1.1 objectIdentifier ldapOID OID:2 objectIdentifier attributetypeOID ldapOID:1 objectIdentifier objectclassOID ldapOID:2 attributeType ( attributetypeOID:1 NAME 'mailAddress' DESC 'email address(es)' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) attributeType ( attributetypeOID:2 NAME 'maildrop' DESC 'Mail addresses where mail is delivered -- ie forwards' SUP mailAddress ) attributeType ( attributetypeOID:3 NAME 'mailid' DESC 'Mail addresses accepted by this account -- ie aliases' SUP mailAddress ) attributeType ( attributetypeOID:4 NAME 'mailquota' DESC 'Bytes of mail quota' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} SINGLE-VALUE ) attributetype ( attributetypeOID:5 NAME 'maildir' DESC 'where mail is stored' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} SINGLE-VALUE ) objectclass ( objectclassOID:1 NAME 'mailAccount' DESC 'users who receive mail' AUXILIARY MAY (maildrop $ mailid $ mailquota $ maildir) ) TIA, Josh Miller, RHCE

4 11

Shell script to monitor LDAP server
by Alexandre Vieira 13 Jun '08

13 Jun '08

Hello all, I have a Solaris 10 system that queries a clients openldap server to deliver a certain service and the client is complaining that my system sometimes denies services to clients. Well my system only denies service to clients if the openldap system from the customer fails to answer. In this sense I tried to write a script to monitor the openldap server and its responsiveness but ldapsearch client in Solaris 10 doesn't work as I expected :( For example, all ok: bash# ldapsearch -v -b '' -s base -h 192.168.1.102:7323 'objectclass=top' namingContexts ldapsearch: started Fri Jun 13 01:51:53 2008 ldap_init( 192.168.1.102:7323, 389 ) filter pattern: objectclass=top returning: namingContexts filter is: (objectclass=top) version: 1 dn: namingContexts: nodeName=XXXXX 1 matches Now imagine that the ldap server goes down: bash# ldapsearch -v -b '' -s base -h 192.168.1.102:7323 'objectclass=top' namingContexts ldapsearch: started Fri Jun 13 02:11:04 2008 ldap_init( 192.168.1.102:7323, 389 ) filter pattern: objectclass=top returning: namingContexts filter is: (objectclass=top) ldap_search: Can't connect to the LDAP server - Connection refused Now imagine that the machine hosting LDAP goes down or a problem somewhere in the network occurs or a firewall blocks traffic (timeout): bash# ldapsearch -v -b '' -s base -h 192.168.1.102:7323 'objectclass=top' namingContexts ldapsearch: started Fri Jun 13 02:11:04 2008 ldap_init( 192.168.1.102:7323, 389 ) filter pattern: objectclass=top returning: namingContexts filter is: (objectclass=top) And it just stays here forever. The -l flag only works after the search is initiated server side. There isn't a switch for a connection timeout limit. With this behaviour I can't test this as I imagined. Maybe some of you already have a monitoring script? Thanks in advance for any tip! PS: The script I wrote initially: ############################################################## #!/bin/bash LDAP_HOST=127.0.0.1:10000 POOLING_INTERVAL=5 LOGFILE=/var/log/ldap_watchdog.log # echo "Watchdog started at `date`" >> $LOGFILE while `/bin/true`; do ldapsearch -v -b '' -s base -h $LDAP_HOST 'objectclass=top' namingContexts if [ $? -ne 0 ]; then echo "`date`: Could not establish connection to LDAP server" >> $LOGFILE fi sleep $POOLING_INTERVAL done ############################################################## Alexandre Vieira - nullpt(a)gmail.com

3 4

LDAP group memberships not working
by Doug Grantham 13 Jun '08

13 Jun '08

Hey, I'm setting up a small network with LDAP and I'm running into a little trouble. The openldap server is on a Suse linux box and the clients are on solaris 10. Currently I'm trying to configure user authentication and group memberships. So far I have the authentication working. Users can log in on any of the solaris workstations. However, when these users log in, they are not part of the correct groups. The only group that user is a member of is their default group. But when that user logs in on the linux server, things work just great and they're members of all the correct groups. For example: USER1 is part of groups AAA, BBB, and CCC with their default group as BBB. When this user logs into the linux server and performs the 'groups' command, it will show this user is part of all three groups AAA, BBB, and CCC. However, when this user logs into the solaris client and perform's the 'groups' command, they're only a member of the BBB group. The /etc/nsswitch.conf on the solaris machine is configure like: passwd: files ldap group: files ldap host: files ipnodes: files netgroup: etc... The /var/ldap/ldap_client_file on the solaris machine is configured like: NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_SERVERS= 12.12.74.122 NS_LDAP_SEARCH_BASEDN= dc=mydomain,dc=edu NS_LDAP_AUTH= simple NS_LDAP_CACHETTL= 0 NS_LDAP_CREDENTIAL_LEVEL= proxy Here is an ldapsearch command and the results: ldapsearch -b "dc=mydomain,dc=edu" -h server1 "(objectclass=groupofnames)" dn: cn=AAA,ou=group,dc=mydomain,dc=edu cn: AAA gidNumber: 601 member: uid=USER1,ou=people,dc=mydomain,dc=edu member: uid=USER2,ou=people,dc=mydomain,dc=edu member: uid=USER3,ou=people,dc=mydomain,dc=edu objectClass: top objectClass: posixGroup objectClass: groupofnames dn: cn=BBB,ou=group,dc=mydomain,dc=edu cn: BBB gidNumber: 602 member: uid=USER1,ou=people,dc=mydomain,dc=edu member: uid=USER3,ou=people,dc=mydomain,dc=edu objectClass: top objectClass: posixGroup objectClass: groupofnames dn: cn=CCC,ou=group,dc=mydomain,dc=edu cn: CCC gidNumber: 603 member: uid=USER1,ou=people,dc=mydomain,dc=edu member: uid=USER2,ou=people,dc=mydomain,dc=edu member: uid=USER4,ou=people,dc=mydomain,dc=edu objectClass: top objectClass: posixGroup objectClass: groupofnames This has been a really weird problem. The default groups are getting properly set but none of the other memberships are working. I've not found any help online and I'm pulling my hair out!

3 2

Re: Shell script to monitor LDAP server
by karim.bourenane＠orange-ftgroup.com 13 Jun '08

13 Jun '08

Hello You cal also install HOBBIT ( old name Big Brother ) freeware with server and client side. Hobbit can send you email or notification by SMS .... you have also in, MRTG graph. Regards Karim Bourenane Orange Business Services / Equant RO&SI / IBNF / ENO / GNS 112 Avenue Charles de Gaules 92200 Neuilly S/Seine Phone: +33156 76 35 52 Fax: +33156 76 35 04 http://www.equant.com "Dieter Kluenter" <dieter(a)dkluenter.de> Sent by: openldap-technical-bounces+karim.bourenane=orange-ftgroup.com(a)OpenLDAP.org 13/06/2008 10:40 To: openldap-technical(a)openldap.org cc: bcc: Subject: Re: Shell script to monitor LDAP server "Alexandre Vieira" <nullpt(a)gmail.com> writes: > Hello all, > > I have a Solaris 10 system that queries a clients openldap server to deliver a > certain service and the client is complaining that my system sometimes denies > services to clients. Well my system only denies service to clients if the > openldap system from the customer fails to answer. > > In this sense I tried to write a script to monitor the openldap server and its > responsiveness but ldapsearch client in Solaris 10 doesn't work as I expected > :( > > For example, all ok: > > bash# ldapsearch -v -b '' -s base -h 192.168.1.102:7323 'objectclass=top' > namingContexts > ldapsearch: started Fri Jun 13 01:51:53 2008 You should search the monitor backend, with something like ldapsearch -b "cn=connections,cn=monitor" -s sub -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6

1 0

Re: [BSD7.0] Openldap Server - Client 2.3.41 / Unknow user UID
by karim.bourenane＠orange-ftgroup.com 13 Jun '08

13 Jun '08

Hi Karic I make modification, but the error is already here :/ Regards Karim Bourenane Orange Business Services / Equant RO&SI / IBNF / ENO / GNS 112 Avenue Charles de Gaules 92200 Neuilly S/Seine Phone: +33156 76 35 52 Fax: +33156 76 35 04 http://www.equant.com "Almir Karic" <redduck666(a)gmail.com> Sent by: openldap-technical-bounces+karim.bourenane=orange-ftgroup.com(a)OpenLDAP.org 12/06/2008 15:22 To: karim.bourenane(a)orange-ftgroup.com cc: openldap-technical(a)openldap.org bcc: Subject: Re: [BSD7.0] Openldap Server - Client 2.3.41 / Unknow user UID i solved the same error by running nscd. On Thu, Jun 12, 2008 at 2:56 PM, <karim.bourenane(a)orange-ftgroup.com> wrote: > > Hi All > > I send you my actual problem, because i cannot resolve from 1 week :/. > I've installed openldap 2.3.41 server and client on server. Ssh running fine > with sudo. But if i do SCP command from another server i have this error : > > server-without-ldap# scp kbourena@ldap-rain:/home/kbourena/toto.txt . > Password: > unknown user 1206 > > If anyone have idea. > > Best Regards > > Karim Bourenane > Orange Business Services / Equant > RO&SI / IBNF / ENO / GNS > 112 Avenue Charles de Gaules > 92200 Neuilly S/Seine > Phone: +33156 76 35 52 > Fax: +33156 76 35 04 > http://www.equant.com > > -- For far too long, power has been concentrated in the hands of "root" and his "wheel" oligarchy. We have instituted a dictatorship of the users. All system administration functions will be handled by the People's Committee for Democratically Organizing the System (PC-DOS).

2 1

How to lock user
by Gustavo Mendes de Carvalho 13 Jun '08

13 Jun '08

Hi there, Is there any way to lock user in LDAP database ? I mean, in linux, it's possible to use passwd <username> -l to lock user and -u to unlock. Is there a similar function in LDAP ? Thanks --- Gustavo Mendes de Carvalho e-mail: gmcarvalho(a)gmail.com

5 9

additional info: homePhone: value #0 normalization failed
by Jay Jesus Amorin 12 Jun '08

12 Jun '08

ldapadd -x -D "cn=Administrator,dc=house,dc=org" -w 12345678 -f /home/ja9/data.ldif adding new entry "cn=labacan,ou=house_backup,dc=house,dc=org" ldap_add: Invalid syntax (21) additional info: homePhone: value #0 normalization failed Please help, Jay

2 1

Re: help with ldapsearch on uid
by joshua＠itsecureadmin.com 12 Jun '08

12 Jun '08

> Hi Joshua > > And without -ZZ, mean ldaps research in local server ? > Without -ZZ would be without TLS, which is working fine. Thanks, Josh Miller, RHCE

1 0

Re: help with ldapsearch on uid
by karim.bourenane＠orange-ftgroup.com 12 Jun '08

12 Jun '08

Hi Joshua And without -ZZ, mean ldaps research in local server ? Reagrds Karim Bourenane Orange Business Services / Equant RO&SI / IBNF / ENO / GNS 112 Avenue Charles de Gaules 92200 Neuilly S/Seine Phone: +33156 76 35 52 Fax: +33156 76 35 04 http://www.equant.com joshua(a)itsecureadmin.com Sent by: openldap-technical-bounces+karim.bourenane=orange-ftgroup.com(a)OpenLDAP.org 12/06/2008 17:01 To: openldap-technical(a)openldap.org cc: bcc: Subject: help with ldapsearch on uid Hello, I am using OpenLDAP 2.4.9 on CentOS 5.1 (32 bit) with a custom schema and I have added ~7500 objects and I am not able to search successfully for these objects by uid. What must I do to be able to search for these objects by uid? Sample object: # 496user, People, example.com dn: uid=496user,ou=People,dc=example,dc=com objectClass: mailAccount maildrop: 496user(a)nest.tld mailid: 496user(a)nest.tld maildir: 496user/ userPassword:: secret mailquota: 35969216S If I search for this user by uid, I will get no results back: # ldapsearch -xZZ -b "ou=people,dc=example,dc=com" uid=496user # extended LDIF # # LDAPv3 # base <ou=people,dc=example,dc=com> with scope subtree # filter: uid=496user # requesting: ALL # # search result search: 3 result: 0 Success # numResponses: 1 Searching by mailid does work: # ldapsearch -xZZ -b "ou=people,dc=example,dc=com" mailid=496user(a)nest.tld ...<snip>... dn: uid=496user,ou=People,dc=example,dc=com objectClass: mailAccount maildrop: 496user(a)nest.tld mailid: 496user(a)nest.tld maildir: 496user/ userPassword:: secret mailquota: 35969216S # search result search: 3 result: 0 Success # numResponses: 2 # numEntries: 1 The schema is as follows (downloaded from riseuplabs.org): objectIdentifier OID 1.1 objectIdentifier ldapOID OID:2 objectIdentifier attributetypeOID ldapOID:1 objectIdentifier objectclassOID ldapOID:2 attributeType ( attributetypeOID:1 NAME 'mailAddress' DESC 'email address(es)' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) attributeType ( attributetypeOID:2 NAME 'maildrop' DESC 'Mail addresses where mail is delivered -- ie forwards' SUP mailAddress ) attributeType ( attributetypeOID:3 NAME 'mailid' DESC 'Mail addresses accepted by this account -- ie aliases' SUP mailAddress ) attributeType ( attributetypeOID:4 NAME 'mailquota' DESC 'Bytes of mail quota' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} SINGLE-VALUE ) attributetype ( attributetypeOID:5 NAME 'maildir' DESC 'where mail is stored' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} SINGLE-VALUE ) objectclass ( objectclassOID:1 NAME 'mailAccount' DESC 'users who receive mail' AUXILIARY MAY (maildrop $ mailid $ mailquota $ maildir) ) TIA, Josh Miller, RHCE

1 0

Re: [BSD7.0] Openldap Server - Client 2.3.41 / Unknow user UID
by karim.bourenane＠orange-ftgroup.com 12 Jun '08

12 Jun '08

Hi Karic Thanks you for your reply. I started nscd with nscd.conf : enable-cache passwd yes enable-cache group yes enable-cache hosts yes enable-cache services yes enable-cache protocols yes enable-cache rpc yes enable-cache networks yes I can put also some value about positive cache ? as : positive-time-to-live passwd 600 negative-time-to-live passwd 20 suggested-size passwd 211 Regards Karim Bourenane Orange Business Services / Equant RO&SI / IBNF / ENO / GNS 112 Avenue Charles de Gaules 92200 Neuilly S/Seine Phone: +33156 76 35 52 Fax: +33156 76 35 04 http://www.equant.com "Almir Karic" <redduck666(a)gmail.com> Sent by: openldap-technical-bounces+karim.bourenane=orange-ftgroup.com(a)OpenLDAP.org 12/06/2008 15:22 To: karim.bourenane(a)orange-ftgroup.com cc: openldap-technical(a)openldap.org bcc: Subject: Re: [BSD7.0] Openldap Server - Client 2.3.41 / Unknow user UID i solved the same error by running nscd. On Thu, Jun 12, 2008 at 2:56 PM, <karim.bourenane(a)orange-ftgroup.com> wrote: > > Hi All > > I send you my actual problem, because i cannot resolve from 1 week :/. > I've installed openldap 2.3.41 server and client on server. Ssh running fine > with sudo. But if i do SCP command from another server i have this error : > > server-without-ldap# scp kbourena@ldap-rain:/home/kbourena/toto.txt . > Password: > unknown user 1206 > > If anyone have idea. > > Best Regards > > Karim Bourenane > Orange Business Services / Equant > RO&SI / IBNF / ENO / GNS > 112 Avenue Charles de Gaules > 92200 Neuilly S/Seine > Phone: +33156 76 35 52 > Fax: +33156 76 35 04 > http://www.equant.com > > -- For far too long, power has been concentrated in the hands of "root" and his "wheel" oligarchy. We have instituted a dictatorship of the users. All system administration functions will be handled by the People's Committee for Democratically Organizing the System (PC-DOS).

1 0

[BSD7.0] Openldap Server - Client 2.3.41 / Unknow user UID
by karim.bourenane＠orange-ftgroup.com 12 Jun '08

12 Jun '08

Hi All I send you my actual problem, because i cannot resolve from 1 week :/. I've installed openldap 2.3.41 server and client on server. Ssh running fine with sudo. But if i do SCP command from another server i have this error : server-without-ldap# scp kbourena@ldap-rain:/home/kbourena/toto.txt . Password: unknown user 1206 If anyone have idea. Best Regards Karim Bourenane Orange Business Services / Equant RO&SI / IBNF / ENO / GNS 112 Avenue Charles de Gaules 92200 Neuilly S/Seine Phone: +33156 76 35 52 Fax: +33156 76 35 04 http://www.equant.com

2 1

Solutions for creating a Samba4 OpenLDAP backend
by Andrew Bartlett 12 Jun '08

12 Jun '08

I've had a very useful discussion with Howard on IRC this morning, and wanted to summarise it for the lists. It follows on from http://www.openldap.org/its/index.cgi?findid=5534 We looked at a few things that were getting in the way of the consistency I need for Samba4. My primary gripe at the moment is the need to have invalid links detected at the time of creation, and to ensure that if this happens, nothing changes in the database. This is the main test that currently fails against the OpenLDAP backend. (In short, everything else seems to work!). The trivial solution to this is a pre-check of the consequences of the operation before attempting it. This will be racy (delete concurrent with adding a DN as a member), but can be backed by a transaction when that functionality is exposed. The problem with doing a pre-check is database loads and replication. In the replicated case, we can simply not check consistency except on the original server, as we will catch up to consistency pretty soon (catastrophic replication failures aside). For database loads (from a dump), we can simply permit inconsistent links by means of a configuration option, and hope that the admin knows what they are doing, and that the DB will be consistent at the conclusion. If we get this much done, then I think Samba4 and OpenLDAP can continue the forward march. I look forward to having Samba4 'powered by OpenLDAP', because without it (or a Fedora DS backend, with whom I'm having a similar discussion) Samba4 does not have a replicated deployment modal. Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

1 0

slapd[26189]: warning: cannot open /etc/hosts.allow: Too many open files
by Andreas Moroder 12 Jun '08

12 Jun '08

Hello, today a client to connect via ftp to our server ( SLES 9 ) and I got this error: slapd[26189]: warning: cannot open /etc/hosts.allow: Too many open files according to lsof | grep REG | wc -l i have only 3267 regular files open and 4684 counting the IP connections too. cat /proc/sys/fs/file-nr returns 3573 1185 131072 and file-max 131072 ( as above ) According to this numbers there sould not be a system wide problem. Is there a limit of open files in slapd ? I restarted slapd and now it seems to work. Probably you need to know the version. Can anyone tell me how I get the running version ? There are no entries in /var/log/messages Thanks Andreas

5 5

[ Ldap Native client Solaris 10 conncet to openldap serveur RHEL ]
by Phuong VUONG 11 Jun '08

11 Jun '08

Hello, First, i m sorry about my English. I have an Openldap 2.3.39 Server RHEL 4.6 which work perfectly. All the authentification from Linux client are fine (with the ACL on and the option of host_chech_attr). However, I have some problem to connect a ldap client native Solaris 10. I use ldapclient manual to configure the Solaris client. The option is : #ldapclient -v manual -a "defaultServerList=IP_SERVER_OPENLDAP_RHEL" -a "credentialLevel=proxy" -a "proxyDN=cn=account,dc=example,dc=fr" -a "proxyPassword=Pass" -a "defaultSearchBase=dc=exemple,dc=fr" -a "defaultSearchScope=sub" -a "serviceSearchDescriptor=passwd:ou=People,dc=exemple,dc=fr?one" -a "serviceSearchDescriptor=shadow:ou=People,dc=exempl,dc=fr?one" -a "serviceSearchDescriptor=groupe:ou=Group,dc=exempl,dc=fr?one" When my ACL are activated, this command turne over timeout and the result are : When i put this below ACL on Openldap Server : access to * by * read. ldapclient is ok and the configuration are fine. But disable the ACL is not possible. In the Openldap server log, i can see : conn=6 op=0 BIND dn="" method=128 ... I dont know why the option -a "proxyDN=cn=account,dc=example,dc=fr" didn't send correctly.. Do anyone have this kind of problem ? Do you get any information about solaris ldap native client connect to an openldap server rhel ? I also follow some guide from : http://docs.lucidinteractive.ca/index.php/Solaris_LDAP_client_with_OpenLDAP… but it don't work neither. Any advice ? Thanks by advance for your answer and pardon me about my poor English.

2 1

Vote OpenLDAP for the 2008 Community Choice Awards!
by Gavin Henry 10 Jun '08

10 Jun '08

http://blog.suretecsystems.com/archives/121-Vote-OpenLDAP-for-the-2008-Comm… -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP.

1 0

Syncrepl : Monitor Replication issues
by smainklh＠free.fr 10 Jun '08

10 Jun '08

Hi everybody! I would like to know how to monitor syncrepl. Actually i would like to be warned when data have been rejected (failure on the provider, network issues ...). Thank you in advance, Smaïn

3 5

How to implement some relational behavior...
by AlexanDER Franca 09 Jun '08

09 Jun '08

Hi. How can I, or what tool must I use, to implement a relational visualization of groups on a LDAP directory? In other words, I need some system that permit users go to an specifc group and see a list of users of that group. And have some way to click on user and see the user informations. Must I develop a tool to to this... or is there some tool (web tool) that I can download and install in a Linux box? []'s Alexander Brazil - Rio de Janeiro

3 4

LDAP structure
by Fred Zinsli 09 Jun '08

09 Jun '08

Hi everyone I am completely new to LDAP so I hope my terminology is correct. I am looking at setting up an LDAP server but I can't find information on how I would like it structured. All of the information I find is based on a single directory tree: ie. domain.com and then under that you can have your sub domains. But I would like to be able to have multiple domains. domain1.com, domain2.com. domain1.co.uk, domain1.com.jp and so on. Is this at all possible using LDAP? If it is possible could someone please point me to some information on how I can do this. I don't explicitly want the answer given to me as I won't learn anything. Many thanks in advance for your help and patience. Regards Fred

3 2

Syncprov overlay not pushing change
by Chris 08 Jun '08

08 Jun '08

openldap 2.3.41 from FreeBSD 6.3 ports. I have been using a syncrepl setup for some time and it's been working great. I recently had an app written that allows a user to change his password. It works, but when the user binds and modifies userPassword, the syncprov overlay does not push the change to the refreshAndPersist consumer. contextCSN is updated, entryCSN is updated, but the "search" never gets pushed. If I disconnect the consumer and reconnect, the change is then propagated. If I use refreshOnly, everything works fine. If the same record is modified by rootdn, the update is sent immediately. Nothing is different except the credentials of the user that binds to do the entry modification I've tried everything I can think of short of going to 2.4 to see if it does the same thing. Any suggestions appreciated.

2 1

OpenLDAP & Thunderbird with SSL
by Erik Lotspeich 08 Jun '08

08 Jun '08

Hi: I have OpenLDAP set up and working such that Thunderbird can access my addressbook without SSL or authentication. This part is good, but I want to move to the next level. My OpenLDAP server (slapd) is set up with SASL authentication (using the PLAIN method) and a self-signed certificate. The slapd command line is: /usr/local/libexec/slapd -h ldap:/// ldaps:/// When I connect to my OpenLDAP server using an OpenLDAP client such as ldapsearch, everything works (I have my self-generated CA cert as part of my system's ca-bundle): ldapsearch -ZZ -b 'ou=xxx, dc=yyy,dc=zzz' '(objectclass=*)' ldapsearch prompts for authentication and returns the contents of my addressbook: SASL/PLAIN authentication started Please enter your password: SASL username: erik SASL SSF: 0 # extended LDIF # # LDAPv3 # base <ou=xxx, dc=yyy,dc=zzz> with scope subtree # filter: (objectclass=*) # requesting: ALL # . . . When I enable SSL in Thunderbird, Thunderbird is unable to connect. I know using tcpdump that it's attempting a connection on the SSL port, but is failing and giving up somewhere. Is this a known issue? In slapd.conf I'm not requiring authentication at the moment. I will require authentication once I get the SSL working; since I'm using PLAIN, I don't want to allow non-SSL authentication. Any help would be greatly appreciated. Regards, Erik.

1 0

slapcat: symbol lookup error ldap_pvt_sasl_mutex_unlock
by M. Todd Smith 07 Jun '08

07 Jun '08

Hello all, I'm currently looking at upgrading my LDAP server from version 2.3.19. In trying to slapcat my db from the old machine I am getting the following error: slapcat: symbol lookup error: slapcat: undefined symbol: ldap_pvt_sasl_mutex_unlock I get this error whenever I attempt to use any of the slap tools. There is a little noise on the web in regards to the ldap_pvt_sasl_mutex_unlock but nothing definitive that I can find. I am going to replicate the db if possible and see if I can slapcat them from a different machine. Barring that however it would be good to be able to solve this from the original perspective. Any ideas? Many thanks in advance. Cheers Todd Systems Administrator -- Soho VFX 99 Atlantc Ave. Suite 303 Toronto, Ontario M6K-3J8 (416)516-7863 x240

1 0

Password policy questions
by Vincent Panel 07 Jun '08

07 Jun '08

Hi list, I'd like to do something rather simple (at least to me) with password policy : * Ensure the userPassword is 6 characters long at least * Ensure there's at least onenumber * Ensure there's at least one uppercase character I found out my first condition can be set by using the pwdMinLength attribute and the ppolicy overlay, but what should I do for the other two ? If it implies using pwdCheckModule and writing a C function and plugging it into openldap then I find it rather difficult for an ldap administrator just wanting to enforce policies... Is there any plan to make things easier, like having openldap providing 2 or 3 default C functions for this module ? Finally, why is it taking so long for the IETF to approve the ppolicy draft published in 2001 ? Has the effort been abandonned ? Thanks, Vincent

2 2

Trouble authenticating using OSX 10.4 and Openldap 2.4
by Donald Thompson 07 Jun '08

07 Jun '08

I have an openldap 2.4 authentication system, that works smoothly with many versions of linux, and OSX 10.5. But I can't get OSX 10.4 to authenticate with it. I was previously using openldap 2.0.27 with an identical setup, and 10.4 was able to authenticate with it. I can su to user accounts that are in the ldap database, but when I'm required to enter a password for the user, the authentication fails. Heres the relevant section from my logfile when I try to authenticate: Jun 6 16:03:58 owl slapd[10661]: conn=22 op=20 SRCH base="dc=mydomain,dc=gov" scope=2 deref=0 filter="(&(|(objectClass=posixAccount)(objectClass=inetOrgPerson)(objectClass=shadowAccount))(|(|(uid=dthomp))(|(cn=dthomp))))" Jun 6 16:03:58 owl slapd[10661]: conn=22 op=20 SRCH attr=uid cn Jun 6 16:03:58 owl slapd[10661]: <= bdb_equality_candidates: (uid) not indexed Jun 6 16:03:58 owl slapd[10661]: <= bdb_equality_candidates: (cn) not indexed Jun 6 16:03:58 owl slapd[10661]: conn=22 op=20 SEARCH RESULT tag=101 err=0 nentries=1 text= Jun 6 16:03:58 owl slapd[10661]: conn=22 op=21 SRCH base="dc=mydomain,dc=gov" scope=2 deref=0 filter="(&(|(objectClass=posixAccount)(objectClass=inetOrgPerson)(objectClass=shadowAccount))(|(uid=dthomp)(cn=dthomp)))" Jun 6 16:03:58 owl slapd[10661]: conn=22 op=21 SRCH attr=userPassword Jun 6 16:03:58 owl slapd[10661]: <= bdb_equality_candidates: (uid) not indexed Jun 6 16:03:58 owl slapd[10661]: <= bdb_equality_candidates: (cn) not indexed Jun 6 16:03:58 owl slapd[10661]: conn=22 op=21 SEARCH RESULT tag=101 err=0 nentries=1 text= Jun 6 16:03:58 owl slapd[10661]: conn=22 op=22 SRCH base="dc=mydomain,dc=gov" scope=2 deref=0 filter="(&(|(objectClass=posixAccount)(objectClass=inetOrgPerson)(objectClass=shadowAccount))(|(uid=dthomp)(cn=dthomp)))" Jun 6 16:03:58 owl slapd[10661]: <= bdb_equality_candidates: (uid) not indexed Jun 6 16:03:58 owl slapd[10661]: <= bdb_equality_candidates: (cn) not indexed Jun 6 16:03:58 owl slapd[10661]: conn=22 op=22 SEARCH RESULT tag=101 err=0 nentries=1 text= Jun 6 16:03:58 owl slapd[10661]: conn=35 fd=20 ACCEPT from IP=192.168.1.145:49405 (IP=0.0.0.0:636) Jun 6 16:03:58 owl slapd[10661]: conn=35 fd=20 closed (TLS negotiation failure) Jun 6 16:03:59 owl slapd[10661]: conn=36 fd=20 ACCEPT from IP=192.168.1.145:49406 (IP=0.0.0.0:636) Jun 6 16:03:59 owl slapd[10661]: conn=36 fd=20 TLS established tls_ssf=32 ssf=32 Jun 6 16:03:59 owl slapd[10661]: conn=36 op=0 BIND dn="" method=163 Jun 6 16:03:59 owl slapd[10661]: conn=36 op=0 RESULT tag=97 err=14 text=SASL(0): successful result: Jun 6 16:03:59 owl slapd[10661]: conn=36 op=1 BIND dn="" method=163 Jun 6 16:03:59 owl slapd[10661]: SASL [conn=36] Failure: no secret in database Jun 6 16:03:59 owl slapd[10661]: conn=36 op=1 RESULT tag=97 err=49 text=SASL(-13): user not found: no secret in database Jun 6 16:03:59 owl slapd[10661]: conn=36 op=2 UNBIND Jun 6 16:03:59 owl slapd[10661]: conn=36 fd=20 closed Jun 6 16:03:59 owl slapd[10661]: conn=22 op=23 SRCH base="dc=mydomain,dc=gov" scope=2 deref=0 filter="(&(|(objectClass=posixAccount)(objectClass=inetOrgPerson)(objectClass=shadowAccount))(|(|(uid=dthomp))(|(cn=dthomp))))" Jun 6 16:03:59 owl slapd[10661]: conn=22 op=23 SRCH attr=uid cn Jun 6 16:03:59 owl slapd[10661]: <= bdb_equality_candidates: (uid) not indexed Jun 6 16:03:59 owl slapd[10661]: <= bdb_equality_candidates: (cn) not indexed Jun 6 16:03:59 owl slapd[10661]: conn=22 op=23 SEARCH RESULT tag=101 err=0 nentries=1 text= Jun 6 16:03:59 owl slapd[10661]: conn=22 op=24 SRCH base="dc=mydomain,dc=gov" scope=2 deref=0 filter="(&(|(objectClass=posixAccount)(objectClass=inetOrgPerson)(objectClass=shadowAccount))(|(uid=dthomp)(cn=dthomp)))" Jun 6 16:03:59 owl slapd[10661]: conn=22 op=24 SRCH attr=userPassword Jun 6 16:03:59 owl slapd[10661]: <= bdb_equality_candidates: (uid) not indexed Jun 6 16:03:59 owl slapd[10661]: <= bdb_equality_candidates: (cn) not indexed Jun 6 16:03:59 owl slapd[10661]: conn=22 op=24 SEARCH RESULT tag=101 err=0 nentries=1 text= Jun 6 16:03:59 owl slapd[10661]: conn=22 op=25 SRCH base="dc=mydomain,dc=gov" scope=2 deref=0 filter="(&(|(objectClass=posixAccount)(objectClass=inetOrgPerson)(objectClass=shadowAccount))(|(uid=dthomp)(cn=dthomp)))" Jun 6 16:03:59 owl slapd[10661]: <= bdb_equality_candidates: (uid) not indexed Jun 6 16:03:59 owl slapd[10661]: <= bdb_equality_candidates: (cn) not indexed Jun 6 16:03:59 owl slapd[10661]: conn=22 op=25 SEARCH RESULT tag=101 err=0 nentries=1 text= Jun 6 16:03:59 owl slapd[10661]: conn=37 fd=20 ACCEPT from IP=192.168.1.145:49407 (IP=0.0.0.0:636) Jun 6 16:03:59 owl slapd[10661]: conn=37 fd=20 closed (TLS negotiation failure) Jun 6 16:03:59 owl slapd[10661]: conn=38 fd=20 ACCEPT from IP=192.168.1.145:49408 (IP=0.0.0.0:636) Jun 6 16:03:59 owl slapd[10661]: conn=38 fd=20 TLS established tls_ssf=32 ssf=32 Jun 6 16:03:59 owl slapd[10661]: conn=38 op=0 BIND dn="" method=163 Jun 6 16:03:59 owl slapd[10661]: conn=38 op=0 RESULT tag=97 err=14 text=SASL(0): successful result: Jun 6 16:03:59 owl slapd[10661]: conn=38 op=1 BIND dn="" method=163 Jun 6 16:03:59 owl slapd[10661]: SASL [conn=38] Failure: no secret in database Jun 6 16:03:59 owl slapd[10661]: conn=38 op=1 RESULT tag=97 err=49 text=SASL(-13): user not found: no secret in database Jun 6 16:03:59 owl slapd[10661]: conn=38 op=2 UNBIND Jun 6 16:03:59 owl slapd[10661]: conn=38 fd=20 closed I'm not sure why its trying to use sasl to authenticate, or even sure if thats the problem. I ended up creating an empty sasl database, because originally it kept trying to open one that wasn't there. Do I have to do some king of mapping from the sasl database to ldap?

1 0

can syncrepl do this?
by Stefano Zanmarchi 06 Jun '08

06 Jun '08

Hi, I need to replicate in my local openldap server all the entries in a given subtree of a remote openldap server, but the two DITs differ. That means I'd like to replicate all entries under "dc=people,dc=A,dc=it" (remote server) to "dc=employees,dc=B,dc=it" (local server). Can syncrepl do that? Or is there another way to obtain this? Any help is greatly appreciated, thanks a lot, Stefano

1 0

Password Policy and SASL DIGEST-MD5
by alessandro patrissi 06 Jun '08

06 Jun '08

Hi everyone, I'm using openldap-2.4.8 and cyrus-sasl-2.1.22. I've enabled password policy in my OpenLdap Server and I've seen that when I authenticate myself using SASL DIGEST-MD5 I can make any searches even if my account is locked. In fact I have the following results: ./ldapsearch -b 'uid=apatrissi,ou=people,dc=my-domain,dc=com' -D 'uid=apatrissi,ou=people,dc=my-domain,dc=com' -x -W -e ppolicy '(objectClass=*)' Enter LDAP Password: ldap_bind: Invalid credentials (49); Account locked ./ldapsearch -b 'uid=apatrissi,ou=people,dc=my-domain,dc=com' -W -Y DIGEST-MD5 -U apatrissi '(objectClass=*)' DIGEST-MD5 -U apatrissi '(objectClass=*)' Enter LDAP Password: SASL/DIGEST-MD5 authentication started SASL username: apatrissi SASL SSF: 128 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <uid=apatrissi,ou=people,dc=my-domain,dc=com> with scope subtree # filter: (objectClass=*) # requesting: ALL # # apatrissi, people, my-domain.com dn: uid=apatrissi,ou=people,dc=my-domain,dc=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson ou: people cn: Alessandro Patrissi givenName: Alessandro sn: Patrissi uid: apatrissi userPassword:: YWxleA== mail: alessandro.patrissi(a)commprove.com telephoneNumber: +0039 description: test LDAP # search result search: 3 result: 0 Success # numResponses: 2 # numEntries: 1 Where I can look to solve the problem? Thanks a lot, Alessandro Patrissi

1 0

sasl problem with Scientific Linux / RedHat but not with debian ?!
by Bjørn Nachtwey 05 Jun '08

05 Jun '08

Dear all, I set up a ldap server and want to use sasl/kerberos5 for authetification. well, using debian/etch it works fine. using scientific linux 5.1 (SL5.1) it does not work, not even testsaslauthd works. the configuration of both systems is the same, besides hostname gives on debian just the name and on SL5.1 the FQN. i also tried to compile cyrus/sasl from sources -- just the same. sl being a clone of RHEL, does anyone have the same problem? does anyone have any idea? thanks & best regards, Bjørn -- ######################################################################## Dipl.-Ing. Bjørn Nachtwey Technische Universität Carolo-Wilhelmina zu Braunschweig Gauss-IT-Zentrum (GITZ) -- Abteilung Server Hans-Sommer-Straße 65, 38106 Braunschweig Telephon: +49 (0)531 / 391 - 5535 TeleFax: +49 (0)531 / 391 - 5549 http://www.tu-braunschweig.de/it mailto: b.nachtwey(a)tu-bs.de mailto: c0034031(a)tu-bs.de ######################################################################## PGP-Schluessel: http://www-public.tu-bs.de:8080/~nachtwey/bjoern_nachtwey.asc PGP-Fingerprint: B472 526A A903 4AEB 9269 EC0B 9CDE 7465 CE87 ########################################################################

2 3

slapd-meta question
by danz＠wustl.edu 05 Jun '08

05 Jun '08

We have a scenario that I’m hoping OpenLDAP can offer a solution to. We are in the process of transitioning from one ldap authentication source to another for several of our applications. During the transition we need to be able to authenticate users against one of two different ldap services. Unfortunately our applications do not support the capability to try authentication against multiple services. Would an OpenLDAP setup be able to take the authentication request and attempt to validate it against 2 different backends? I should note that each of the ldap backends would have different OU structures and that a given userID would not exist in both backends. Based on the slapd-meta man page SCENARIOS section it looks as though this may be possible. The examples don't illustrate whether or not the OU structures need to be the same between the backends. Any help would be greatly appreciated! Regards, Dan

4 5

ACLs Seem to Have No Effect
by nick＠ndmckinney.net 05 Jun '08

05 Jun '08

I am having some difficulty setting up the ACLs on my OpenLDAP server (2.4.8). No matter what I change, the ACL rules I write into my slapd.conf file seem to have no effect at all. I have followed the FAQ here to try to set a simple password change ACL: http://www.openldap.org/faq/data/cache/320.html As well as another to try to block Anonymous binds: http://www.openldap.org/faq/data/cache/318.html But neither seem to have any effect at all. My present slapd.conf ACLs are as follows: --- access to attrs=userPassword by self =xw by anonymous auth # allow only rootdn to read the monitor access to * by self write by anonymous none by users read --- Is there some other part of the configuration that might disable ACLs.

4 4

Re: slapd-meta question
by Gavin Henry 04 Jun '08

04 Jun '08

<quote who="Pierangelo Masarati"> > Gavin Henry wrote: > >> I can't see Ando's example in this thread? > > My fault: during a mail migration, my address got automatically > rewritten from ando(a)sys-net.it to the canonical > pierangelo.masarati(a)sys-net.it, which is not the address I used when > subscribing to the mailing list. I think the problem is now fixed > (hopefully :) > > Ah, makes sense now. I thought I was going mad ;-) -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP.

1 0

slapcat/ldapsearch question
by daniel rahmeh 04 Jun '08

04 Jun '08

Hi, i'm trying to export my openldap entries to an ldif file. My userPassword attribute has the following format: userPassword: {CRYPT}$1$$Y2j3VjkaCXmJ.YsPztha89 when i try to export it using slapcat or ldapsearch it doesn't remain the same, it becomes something like: userPassword:: e0NSWJBUfSQxJCRVMm8zVnpJYUNVbUolWHNXenRJKTgw If you have any idea about the origin of the issue please tell me thank you

2 2

Stupid question about search
by AlexanDER Franca 04 Jun '08

04 Jun '08

Hi all. Again, sorry for my horrible english. So... I implemented a ldap server at my work. All the systems are working fine. OpenLDAP have being a great backend. But now I need to satisfy the users. They must perform some 'intuitive' searches like "who are the persons on group X, or list all telephones of people on group Y". But all of this must be executed by 'normal' users. Phpldapadmin have a good interface, but for admins, not for users (IMO). I don't know, for example, about groups... I have groupOfUniquenames, so... if an user want a list of users, and when choose 'users' node of tree, he get all users. To know about a group, he must go to 'groups' node and look at 'uniqueMember'. It seems not too much intuitive. So... I don't know how to implement (and what) to have this stuffs working for my users. []'s Alexander Brazil - Rio de Janeiro

3 2

Re: Delete events not propogating with syncrepl
by Srinidhi Sharma 04 Jun '08

04 Jun '08

Hi, I am using openldap 2.4.9. Deleted entries do not get propagated to slave from master using syncrepl. I had tried the similar use case in 2.4.8 and ran into the same issue. Is this a known issue in 2.4.9 ? Any pointers would be helpful. - Srinidhi. On Tue, May 6, 2008 at 12:42 AM, Gavin Henry <ghenry(a)openldap.org> wrote: > Srinidhi Sharma wrote: > >> Hi Gavin, >> Here are the details . >> Following logs were available at -d255 level. >> >> user.ldif file >> ======== >> dn: cn=user19,ou=people,dc=example,dc=com >> objectclass: inetOrgPerson >> cn: user19 >> sn: user19-lastname1 >> uid: user19-user1-lastname1 >> userpassword: welcome1 >> carlicense: HISCAR 123 >> homephone: 555-111-2222 >> mail: user19(a)example.com <mailto:user19@example.com> >> >> description: cool guy >> ou: Human Resources >> >> >> Master node log file snippet: >> ==================== >> >>> dnPrettyNormal: <cn=user19,ou=people,dc=example,dc=com> >> => ldap_bv2dn(cn=user19,ou=people,dc=example,dc=com,0) >> <= ldap_bv2dn(cn=user19,ou=people,dc=example,dc=com)=0 >> => ldap_dn2bv(272) >> <= ldap_dn2bv(cn=user19,ou=people,dc=example,dc=com)=0 >> => ldap_dn2bv(272) >> <= ldap_dn2bv(cn=user19,ou=people,dc=example,dc=com)=0 >> <<< dnPrettyNormal: <cn=user19,ou=people,dc=example,dc=com>, >> <cn=user19,ou=people,dc=example,dc=com> >> bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") >> => bdb_entry_get: ndn: "cn=user19,ou=people,dc=example,dc=com" >> => bdb_entry_get: oc: "(null)", at: "(null)" >> bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") >> => bdb_entry_get: found entry: "cn=user19,ou=people,dc=example,dc=com" >> bdb_entry_get: rc=0 >> ==> bdb_delete: cn=user19,ou=people,dc=example,dc=com >> bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") >> => access_allowed: delete access to "ou=people,dc=example,dc=com" >> "children" requested >> <= root access granted >> => access_allowed: delete access granted by manage(=mwrscxd) >> => access_allowed: delete access to >> "cn=user19,ou=people,dc=example,dc=com" "entry" requested >> <= root access granted >> => access_allowed: delete access granted by manage(=mwrscxd) >> => bdb_dn2id_delete 0x11: "cn=user19,ou=people,dc=example,dc=com" >> bdb_idl_delete_key: 11 @cn=user19,ou=people,dc=example,dc=com >> bdb_idl_delete_key: 11 %ou=people,dc=example,dc=com >> bdb_idl_delete_key: 11 @ou=people,dc=example,dc=com >> <= bdb_dn2id_delete 0x11: 0 >> => index_entry_del( 17, "cn=user19,ou=people,dc=example,dc=com" ) >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [860433ad] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [0250ebcb] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [8c70ccf9] >> bdb_idl_delete_key: 11 [860433ad] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [0250ebcb] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [8c70ccf9] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [0096defd] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 [e8d6b696] >> <= key_change 0 >> => key_change(DELETE,11) >> bdb_idl_delete_key: 11 >> <= key_change 0 >> <= index_entry_del( 17, "cn=user19,ou=people,dc=example,dc=com" ) success >> ====> bdb_cache_delete( 17 ) >> bdb_delete: deleted id=00000011 dn="cn=user19,ou=people,dc=example,dc=com" >> send_ldap_result: conn=1 op=15 p=3 >> send_ldap_result: err=0 matched="" text="" >> send_ldap_response: msgid=16 tag=107 err=0 >> ber_flush2: 14 bytes to sd 12 >> 0000: 30 0c 02 01 10 6b 07 0a 01 00 04 00 04 00 0....k........ >> ldap_write: want=14, written=14 >> 0000: 30 0c 02 01 10 6b 07 0a 01 00 04 00 04 00 0....k........ >> daemon: activity on 1 descriptor >> daemon: activity on: 12r >> daemon: read activity on 12 >> daemon: select: listen=7 active_threads=0 tvp=NULL >> connection_get(12) >> connection_get(12): got connid=1 >> connection_read(12): checking for input on id=1 >> >> >> Slave log snippet: ( I didnt see any log msg for delete entry in the >> slave, so wasnt sure what to cut/paste, so just cut/pasting the user >> addition log msg) >> ============= >> ber_scanf fmt ({mW}) ber: >> ber_dump: buf=5c5780 ptr=5c5892 end=5c58ca len=56 >> 0000: 30 36 04 08 65 6e 74 72 79 43 53 4e 31 2a 04 28 >> 06..entryCSN1*.( 0010: 32 30 30 38 30 35 30 32 30 39 34 33 34 36 2e 38 >> 20080502094346.8 0020: 38 39 39 34 36 5a 23 30 30 30 30 30 30 23 30 30 >> 89946Z#000000#00 0030: 30 23 30 30 30 30 30 30 >> 0#000000 => bdb_search >> bdb_dn2entry("dc=example,dc=com") >> => access_allowed: search access to "dc=example,dc=com" "entry" requested >> <= root access granted >> => access_allowed: search access granted by manage(=mwrscxd) >> search_candidates: base="dc=example,dc=com" (0x00000001) scope=2 >> => bdb_dn2idl("dc=example,dc=com") >> => bdb_filter_candidates >> AND >> => bdb_list_candidates 0xa0 >> => bdb_filter_candidates >> EQUALITY >> => bdb_equality_candidates (entryUUID) >> => key_read >> bdb_idl_fetch_key: [e8d6b696] >> <= bdb_index_read: failed (-30989) >> <= bdb_equality_candidates: id=0, first=0, last=0 >> <= bdb_filter_candidates: id=0 first=0 last=0 >> <= bdb_list_candidates: id=0 first=1 last=0 >> <= bdb_filter_candidates: id=0 first=1 last=0 >> bdb_search_candidates: id=0 first=1 last=0 >> bdb_search: no candidates >> send_ldap_result: conn=-1 op=0 p=3 >> send_ldap_result: err=0 matched="" text="" >> ==> bdb_add: cn=user19,ou=people,dc=example,dc=com >> bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") >> => bdb_dn2id("cn=user19,ou=people,dc=example,dc=com") >> <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found >> (-30989) >> => access_allowed: add access to "ou=people,dc=example,dc=com" "children" >> requested >> <= root access granted >> => access_allowed: add access granted by manage(=mwrscxd) >> => access_allowed: add access to "cn=user19,ou=people,dc=example,dc=com" >> "entry" requested >> <= root access granted >> => access_allowed: add access granted by manage(=mwrscxd) >> => bdb_dn2id_add 0x11: "cn=user19,ou=people,dc=example,dc=com" >> bdb_idl_insert_key: 11 %ou=people,dc=example,dc=com >> bdb_idl_insert_key: 11 @ou=people,dc=example,dc=com >> <= bdb_dn2id_add 0x11: 0 >> => index_entry_add( 17, "cn=user19,ou=people,dc=example,dc=com" ) >> => key_change(ADD,11) >> bdb_idl_insert_key: 11 [860433ad] >> <= key_change 0 >> => key_change(ADD,11) >> bdb_idl_insert_key: 11 [0250ebcb] >> <= key_change 0 >> => key_change(ADD,11) >> bdb_idl_insert_key: 11 [8c70ccf9] >> <= key_change 0 >> => key_change(ADD,11) >> bdb_idl_insert_key: 11 [0096defd] >> <= key_change 0 >> => key_change(ADD,11) >> bdb_idl_insert_key: 11 [e8d6b696] >> <= key_change 0 >> => key_change(ADD,11) >> bdb_idl_insert_key: 11 >> <= key_change 0 >> <= index_entry_add( 17, "cn=user19,ou=people,dc=example,dc=com" ) success >> => entry_encode(0x00000011): cn=user19,ou=people,dc=example,dc=com >> bdb_add: added id=00000011 dn="cn=user19,ou=people,dc=example,dc=com" >> send_ldap_result: conn=-1 op=0 p=3 >> send_ldap_result: err=0 matched="" text="" >> ldap_msgfree >> ldap_result ld 5b9630 msgid 2 >> wait4msg ld 5b9630 msgid 2 (infinite timeout) >> wait4msg continue ld 5b9630 msgid 2 all 0 >> ** ld 5b9630 Connections: >> >> - Srinidhi >> On Wed, Apr 30, 2008 at 7:53 PM, Gavin Henry <ghenry(a)openldap.org<mailto: >> ghenry(a)openldap.org>> wrote: >> >> Srinidhi Sharma wrote: >> >> Hi, >> I am using open ldap 2.4.8 with Berkeley DB 4.6.21 ( I haven't >> applied any patch to either open ldap or to Berkeley DB). >> >> When I configure a slave process, the addition and modification >> of users get propogated from master to slave. But the deletion >> of users from the master do not get propogated. the slapd logs >> in the master show that user is getting deleted. >> >> >> Logs needed and an example user please ;-) >> >> >> >> I saw a old note >> "http://www.openldap.org/lists/openldap-bugs/200409/msg00001.html" >> which listed similar issue. >> >> >> Not relevant as that's for 2.2. >> >> -- Kind Regards, >> >> Gavin Henry. >> OpenLDAP Engineering Team. >> >> E ghenry(a)OpenLDAP.org >> >> Community developed LDAP software. >> >> http://www.openldap.org/project/ >> >> Suretec Systems is a limited company registered in Scotland. Registered >> number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, >> Aberdeenshire, AB51 4FP. >> >> >> >> >> -- >> Thanks, >> Srinidhi >> > > I'd wait for 2.4.9 as there are lots of syncrepl fixes..coming soon. > > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ > > Suretec Systems is a limited company registered in Scotland. Registered > number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, > Aberdeenshire, AB51 4FP. > -- Thanks, Srinidhi

2 1

Current OpenLDAP Windows Binary
by guse＠kingmedia.de 04 Jun '08

04 Jun '08

Dear all, in a project we use the OpenLDAP proxy feature. Our server infrastructure is based on MS Windows, so it is tough to install a current OpenLDAP version. At the moment we use Cygwin to run OpenLDAP, but this doesn't seem to be the best solution. We searched the web and found OpenLDAP 2.0.27 as a Windows installer. Unfortunately this old version does not accept our configuration which runs like a charm in 2.3.39 we use in Cygwin. Is there anybody out there who can give us a helping hand getting a current windows OpenLDAP build? Regards, Christoph

1 0

Custom Syntaxes
by Jeff Sussna 03 Jun '08

03 Jun '08

Is it possible to add new syntax definitions to LDAP? I've done various searches without unearthing anything. In particular, I'd like to specify a syntax which is "an integer between 0 and 5". Can I do that or do I need to code the enforcement into my client?

2 1

bdb panics with openldap
by Govind c 03 Jun '08

03 Jun '08

We have openldap using the bdb has its database.For some reason the bdb had crashed complaining permission issue. May 13 16:04:40 ccc slapd[30372]: conn=12430 fd=10 ACCEPT from IP=xxx.yyy.zzz.aaa:33905 (IP=0.0.0.0:389) May 13 16:04:40 ccc slapd[30372]: conn=12430 op=0 BIND dn="cn=Directory Manager,o=none.com" method=128 May 13 16:04:40 ccc slapd[30372]: conn=12430 op=0 BIND dn="cn=Directory Manager,o=none.com" mech=SIMPLE ssf=0 May 13 16:04:40 ccc slapd[30372]: conn=12430 op=0 RESULT tag=97 err=0 text= May 13 16:04:40 ccc slapd[30372]: conn=12430 op=1 MOD dn="uid=sysadmin,o=none.com" May 13 16:04:40 ccc slapd[30372]: conn=12430 op=1 MOD noner=lastlogints lastaccessts authcookie May 13 16:04:40 ccc slapd[30372]: bdb(o=none.com): /var/lib/ldap/log.0000000002: log file open failed: Permission denied May 13 16:04:40 ccc slapd[30372]: bdb(o=none.com): PANIC: Permission denied May 13 16:04:40 ccc slapd[30372]: bdb(o=none.com): DB_ENV->log_put: 2: DB_RUNRECOVERY: Fatal error, run database recovery May 13 16:04:40 ccc slapd[30372]: bdb(o=none.com): /var/lib/ldap/log.0000000002: log file open failed: Permission denied The log.000000000 gets rotated based on the size (10MB).The new logfile(log.0000000002) was rotated at on Apr 30th and I believe the permission was set as root:root instead of ldap:ldap(Note: the ldap being run as user ldap).The reason why didnât crash till yesterday was, only search queries were run against the ldap/bdb (The ldap search test for testing ldap keep alive).Yesterday a modify query was run from IP xxx.yyy.zzz.aaa and I guess bdb complained of permission problem and panicked May 13 16:04:40 ccc slapd[30372]: conn=12430 fd=10 ACCEPT from IP=xxx.yyy.zzz.aaa:33905 (IP=0.0.0.0:389) May 13 16:04:40 ccc slapd[30372]: conn=12430 op=0 BIND dn="cn=Directory Manager,o=none.com" method=128 May 13 16:04:40 ccc slapd[30372]: conn=12430 op=0 BIND dn="cn=Directory Manager,o=none.com" mech=SIMPLE ssf=0 May 13 16:04:40 ccc slapd[30372]: conn=12430 op=0 RESULT tag=97 err=0 text= May 13 16:04:40 ccc slapd[30372]: conn=12430 op=1 MOD dn="uid=sysadmin,o=none.com" [root@ccc ldap]# ls -l /var/lib/ldap total 13236 -rw------- 1 ldap ldap 106496 Mar 24 19:30 cn.bdb -rw------- 1 ldap ldap 16384 Mar 20 11:50 __db.001 -rw------- 1 ldap ldap 278528 Mar 20 11:50 __db.002 -rw------- 1 ldap ldap 98304 Mar 20 11:50 __db.003 -rw------- 1 ldap ldap 450560 Mar 20 11:50 __db.004 -rw------- 1 ldap ldap 16384 Mar 20 11:50 __db.005 -rw------- 1 ldap ldap 45056 Mar 24 19:30 dn2id.bdb -rw------- 1 ldap ldap 278528 Apr 2 13:40 id2entry.bdb -rw------- 1 ldap ldap 10485710 Apr 30 14:40 log.0000000001 -rw------- 1 root root 1827874 May 13 16:00 log.0000000002 -rw------- 1 ldap ldap 8192 Mar 20 11:50 mail.bdb -rw------- 1 ldap ldap 16384 Mar 24 19:30 objectClass.bdb -rw-r--r-- 1 ldap ldap 0 Apr 2 13:31 openldap-master-replog -rw-r--r-- 1 ldap ldap 0 Apr 2 13:31 openldap-master-replog.lock -rw------- 1 ldap ldap 8192 Mar 20 11:50 ou.bdb drwxr-xr-x 2 root root 4096 Mar 21 16:33 replica -rw------- 1 ldap ldap 49152 Mar 20 11:50 sn.bdb -rw------- 1 ldap ldap 8192 Mar 20 12:00 uid.bdb The ldap is being run as user ldap [root@ccc ~]# ps -ef | grep ldap root 8983 6956 0 15:40 pts/0 00:00:00 grep ldap ldap 31694 1 0 Mar20 ? 00:01:57 /usr/sbin/slapd -u ldap -h ldap:/// [root@ccc ~]# grep ldap /etc/passwd ldap:x:55:55:LDAP User:/var/lib/ldap:/bin/false Why should a modify cause a panic and not a search?Why did the rotated log had root as owner instead of ldap?Is there a fix for this issue? Cheers CG

3 2

Re: bdb panics with openldap
by Hallvard B Furuseth 03 Jun '08

03 Jun '08

Please keep replies on the list. Govind c writes: > Well I haven`t set any parameter to rotate.I guess the > bdb has some in-built feature where in it rotates > after the log file reached 10M. Ah, OK. I don't think BDB rotates, it just closes the old logfile and starts a new one. I expect that's what they want all the digits for: They don't reuse logfile names, but you are not likely to need 1000000000 logfiles for the lifetime of a database. Anyway, it looks like you have sometimes run slapd or the slap tools as user ldap and sometimes as root, and so the files have conflicting ownership. Make up your mind about the user, chown the files to that user and stick to it. -- Hallvard

1 0

ProFTP + LDAP + SSL (LDAPServer 1.2.3.4:636)
by catia.lavalle＠bechtle.com 03 Jun '08

03 Jun '08

Hello, I do not know if this is the place to ask but maybe some of you have already had this configuration. I have a problem configuring ProFTP to use LDAP over SSL (i.e. ldaps on port 636). In short: ProFTP without TLS (TLSEngine off) DOES authenticate with LDAP without SSL (LDAPServer 1.2.3.4:389) ProFTP with TLS (TLSEngine on, path to the ftp-ssl certificates) DOES authenticate with LDAP without SSL (LDAPServer 1.2.3.4:389) ProFTP with TLS (TLSEngine on, path to the ftp-ssl certificates) DOES NOT authenticate with LDAP with SSL (LDAPUseTLS on; LDAPServer 1.2.3.4:636) The procedure is a 2 way SSL with 2 certificates: filezilla (for example) (acting as client for ProFTP) ->SSL(cert_ftp)-> ProFTP (acting as server for filezilla, cert_ftp) ProFTP (acting as client for LDAP) ->SSL(cert_LDAP)-> LDAP (acting as server for the ProFTP, cert_LDAP). If I look in the logs I see that the ProFTP Server connects to the LDAP server on the correct port, the LDAP server accepts the connection but the TLS fails! In principle for me it is obvious because in the ProFTP configuration I do give the path to the FTP-SSL certificates and keys but I do not input any path for the LDAP-SSL certificates i.e. in my opinion it can not work like this. So my question is how to make it work? As I have said in my opinion the key point is to be able to set the path where the ProFTP server finds the certificates for the LDAP server. I do not find any hint whatsoever in the net. The steps I have done: LDAP Server: The LDAP Server IP (say) 1.2.3.4 The LDAP Server listens to port 636 (ldaps) and port (ldap). I have created a certificate for the LDAP server (slapd.pem, slapd.key) The LDAP server itself is fully functioning on both ldap and ldaps (for example ldaps with apache ok) ProFTP Server: The ProFTP Server IP (say) 5.6.7.8 I have created a certificate for the ProFTP server (ftp2.pem, ftp2.key) I have copied locally the certificates of the LDAP server (slapd.pem) This is exactly what you do with apache (and it works) provided one gives the path for "both" certificates LDAPTrustedGlobalCert CA_BASE64 /apache/conf/ssl_certs/slapd.pem .... .... SSLCertificateFile /apache/conf/ssl_certs/apache.pem SSLCertificateKeyFile /apache/conf/ssl_certs/apache.key This is the ProFTP configuration (mod_tls and mod_ldap parts) <IfModule mod_tls.c> TLSEngine on TLSLog /ftp2/logs/tls.log TLSProtocol SSLv23 TLSOptions NoCertRequest TLSRSACertificateFile /ftp2/conf/ssl_certs/ftp2.pem TLSRSACertificateKeyFile /ftp2/conf/ssl_certs/ftp2.key TLSCACertificateFile /ftp2/conf/ssl_certs/ftp2.pem TLSVerifyClient off TLSRequired on TLSRenegotiate required off </IfModule> <IfModule mod_ldap.c> #LDAPServer 1.2.3.4:389 LDAPUseTLS on LDAPServer 1.2.3.4:636 LDAPDoAuth on "ou=bbb,dc=aaa,dc=de" "(&(uid=%v)(objectclass=posixAccount))" LDAPDNInfo "uid=1234,dc=aaa,dc=de" root LDAPAuthBinds on LDAPDoUIDLookups on "ou=bbb,dc=aaa,dc=de" LDAPSearchScope subtree </IfModule> Both LDAP server and ProFTP (proftp-ldap) server are: Linux version 2.6.18-6-amd64 (Debian 2.6.18.dfsg.1-18etch1) (waldi(a)debian.org) (gcc version 4.1.2 20061115 (prerelease) (Debian 4.1.1-21)) #1 SMP Sun Feb 10 17:50:19 UTC 2008 OpenLDAP server (slapd) dpkg -l | grep slapd ii slapd 2.3.30-5+etch1 I have used the ProFTP with precompiled LDAP (proftp-ldap) dpkg -l | grep proftp ii proftpd 1.3.0-19 Versatile, virtual-hosting FTP daemon ii proftpd-ldap 1.3.0-19 Versatile, virtual-hosting FTP daemon Error in /var/log/syslog from slapd May 27 10:54:05 ftp1test slapd[7323]: daemon: activity on 1 descriptor May 27 10:54:05 ftp1test slapd[7323]: daemon: listen=9, new connection on 19 May 27 10:54:05 ftp1test slapd[7323]: daemon: added 19r (active) listener=(nil) May 27 10:54:05 ftp1test slapd[7323]: conn=106 fd=19 ACCEPT from IP=5.6.7.8:42564 (IP=0.0.0.0:636) May 27 10:54:05 ftp1test slapd[7323]: daemon: select: listen=6 active_threads=0 tvp=NULL May 27 10:54:05 ftp1test slapd[7323]: daemon: select: listen=7 active_threads=0 tvp=NULL May 27 10:54:05 ftp1test slapd[7323]: daemon: select: listen=8 active_threads=0 tvp=NULL May 27 10:54:05 ftp1test slapd[7323]: daemon: select: listen=9 active_threads=0 tvp=NULL May 27 10:54:05 ftp1test slapd[7323]: daemon: activity on 1 descriptor May 27 10:54:05 ftp1test slapd[7323]: daemon: activity on: May 27 10:54:05 ftp1test slapd[7323]: 19r May 27 10:54:05 ftp1test slapd[7323]: May 27 10:54:05 ftp1test slapd[7323]: daemon: read activity on 19 May 27 10:54:05 ftp1test slapd[7323]: daemon: removing 19 May 27 10:54:05 ftp1test slapd[7323]: conn=106 fd=19 closed (TLS negotiation failure) Please Help Thanks.

1 0

could not hard reconnect to LDAP server - Server is unavailable
by Gar Nelson 03 Jun '08

03 Jun '08

"As it quite unlikely that issues raised in your message could not be discussed without talking about the particulars of nss_ldap, your message is more appropriately directed to the openldap-technical list." So, take two. :) Starting openldap takes about five minutes to come up due to all the timeouts indicated in /var/log/messages. I've been googling without success, and openldap-software is not the appropriate venue for discussion of my problem. Hopefully this is, since I'm running out of options on where to look. Thank you for any assistance, or pointers toward the right direction. Gar -------- Original Message -------- Subject: could not hard reconnect to LDAP server - Server is unavailable Date: Fri, 30 May 2008 15:17:32 -0600 From: Gar Nelson <gar.nelson(a)noaa.gov> Organization: National Weather Service To: openldap-software(a)openldap.org I'm currently using openldap-2.2.13-8.el4_6.4 on RHEL 4 and for the most part, it appears to be working. I can use ldap to log in on another machine, and on a different workstation, the Apache directory browser connects and browses (and edits) just fine. However, when watching /var/log/messages, all is not calm under the surface. A shortened snippet of the log is as follows; May 30 14:55:46 ggw-s-bdc runuser: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server May 30 14:55:46 ggw-s-bdc runuser: nss_ldap: reconnecting to LDAP server... May 30 14:55:46 ggw-s-bdc runuser: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server May 30 14:55:46 ggw-s-bdc runuser: nss_ldap: reconnecting to LDAP server... [...] May 30 14:57:46 ggw-s-bdc runuser: nss_ldap: could not hard reconnect to LDAP server - Server is unavailable May 30 14:57:46 ggw-s-bdc slaptest: sql_select option missing May 30 14:57:46 ggw-s-bdc slaptest: auxpropfunc error no mechanism available May 30 14:57:46 ggw-s-bdc runuser: config file testing succeeded May 30 14:57:46 ggw-s-bdc ldap: Checking configuration files for slapd: succeeded May 30 14:57:46 ggw-s-bdc slapd[16932]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server May 30 14:57:46 ggw-s-bdc slapd[16932]: nss_ldap: reconnecting to LDAP server... May 30 14:57:46 ggw-s-bdc slapd[16932]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server May 30 14:57:46 ggw-s-bdc slapd[16932]: nss_ldap: reconnecting to LDAP server... [...] May 30 14:59:46 ggw-s-bdc slapd[16932]: nss_ldap: could not hard reconnect to LDAP server - Server is unavailable May 30 14:59:46 ggw-s-bdc slapd[16932]: sql_select option missing May 30 14:59:46 ggw-s-bdc slapd[16932]: auxpropfunc error no mechanism available May 30 14:59:46 ggw-s-bdc ldap: slapd startup succeeded It takes around five minutes for ldap to come up waiting for all the bind timeouts. I've tried googling without success, I've tried changing from host to uri, and from the local 127 address to the machine's outside IP without success. SELinux is disabled. IPTables is not running. nmap localhost reports port 389 is open, along with an nmap to it's outside ip address. I'm at a loss as to how to get "nss-ldap" to bind. ldap.conf is as follows; # @(#)$Id: ldap.conf,v 1.34 2004/09/16 23:32:02 lukeh Exp $ # # PADL Software # http://www.padl.com # debug 256 logdir /var/log/ldap.log #host 127.0.0.1 base dc=ggw,dc=nws,dc=noaa uri ldap://127.0.0.1/ #uri ldaps://127.0.0.1/ #uri ldapi://%2fvar%2frun%2fldapi_sock/ # Note: %2f encodes the '/' used as directory separator binddn cn=Manager,dc=ggw,dc=nws,dc=noaa bindpw [correct ldap password] port 389 timelimit 50 bind_timelimit 50 bind_policy hard idle_timelimit 3600 pam_password exop nss_base_passwd ou=People,dc=ggw,dc=nws,dc=noaa?one nss_base_passwd ou=Computers,dc=ggw,dc=nws,dc=noaa?one nss_base_shadow ou=People,dc=ggw,dc=nws,dc=noaa?one nss_base_group ou=Groups,dc=ggw,dc=nws,dc=noaa?one #nss_base_hosts ou=Hosts,dc=ggw,dc=nws,dc=noaa?one #nss_base_services ou=Services,dc=ggw,dc=nws,dc=noaa?one #nss_base_networks ou=Networks,dc=ggw,dc=nws,dc=noaa?one #nss_base_protocols ou=Protocols,dc=ggw,dc=nws,dc=noaa?one #nss_base_rpc ou=Rpc,dc=ggw,dc=nws,dc=noaa?one #nss_base_ethers ou=Ethers,dc=ggw,dc=nws,dc=noaa?one #nss_base_netmasks ou=Networks,dc=ggw,dc=nws,dc=noaa?one #nss_base_bootparams ou=Ethers,dc=ggw,dc=nws,dc=noaa?one #nss_base_aliases ou=Aliases,dc=ggw,dc=nws,dc=noaa?one #nss_base_netgroup ou=Netgroup,dc=ggw,dc=nws,dc=noaa?one ssl no tls_cacertdir /etc/openldap/cacerts pam_password md5

2 1

Custom Schema
by openLDAP 03 Jun '08

03 Jun '08

I am quite new to OpenLDAP and cannot seem resolve why slapd does not start when I add a custom schema. Nothing appears in syslog and the following appears when I try to start it: root@control:/etc/ldap# sudo slapd -d acl @(#) $OpenLDAP: slapd 2.4.7 (Apr 29 2008 08:44:27) $ buildd@rothera:/build/buildd/openldap2.3-2.4.7/debian/build/servers/slapd AttributeTypeDescription = "(" whsp numericoid whsp ; AttributeType identifier [ "NAME" qdescrs ] ; name used in AttributeType [ "DESC" qdstring ] ; description [ "OBSOLETE" whsp ] [ "SUP" woid ] ; derived from this other ; AttributeType [ "EQUALITY" woid ] ; Matching Rule name [ "ORDERING" woid ] ; Matching Rule name [ "SUBSTR" woid ] ; Matching Rule name [ "SYNTAX" whsp noidlen whsp ] ; see section 4.3 [ "SINGLE-VALUE" whsp ] ; default multi-valued [ "COLLECTIVE" whsp ] ; default not collective [ "NO-USER-MODIFICATION" whsp ]; default user modifiable [ "USAGE" whsp AttributeUsage ]; default userApplications ; userApplications ; directoryOperation ; distributedOperation ; dSAOperation whsp ")" slapd stopped. Can someone please point me in the right direction to resolving this type of error?

2 1

ldap_bind :Can't contact LDAP server
by Rakesh Yadav 02 Jun '08

02 Jun '08

Hi, I m using openldap-2.3.38 over linux platform. I have written a library using LDAP client API's according to my requirement. I m having RPC clients and a RPC server. This RPC server is multithreaded and uses the library which is written using LDAP client api. The problem is : 1. I have open a single connection with LDAP server and passed the global LDAP * ptr to all my library calls, And i sended a search request from rpc client in a loop, it works and gives the result but as i run second request for reading data from rpc server then i get error from LDAP server "*Broken pipe*". 2. Then i have decided i will use seprate connection with LDAP for each thread and use a local LDAP *ptr for thread. This time multiple requests from rpc client works for 2-3 minutes after that it also gives error. "*ldap_bind :Can't contact LDAP server*" In this case i opened and closed a connection with LDAP server for each thread. Please suggest me some solution for handling multiple threads with LDAP client API. In case of Solaris i got a sample for handling multiple threads with LDAP client api's. But this solution doesn't work over Linux. Please give me some solution. Thanks -- Rakesh Yadav Pune.

1 0

Sync State (Response) Control
by Srinidhi Sharma 02 Jun '08

02 Jun '08

Hi, Is the sync state control support available in 2.4.9 and is it exposed as suported control to JNDI and other client interfaces ? I tried a JNDI program using the novell's ldap.jar implementation, but couldnot get the Sync state control. Is this a known issue or am I missing something ??? I know that, this is not a JNDI forum, but in any of the other JNDI forum's I did not see any postings on Sync state control. Any pointers will be helpful. -- Thanks, Srinidhi

1 0

LDAP in deltasyncrepl method
by Aravind Arjunan 01 Jun '08

01 Jun '08

hi, am configuring openldap 2.3 in RHEL 5 operating system. I need the configuration file for master and slave slapd.conf file for reference. i need to configure *openldap in delta-syncrepl method.* If any one configured openldap in this method plz send me the configuration file reference. or any one plz say me how to configure ldap in master/slave in RHEL 5 OS

5 8

Log system
by Alain Siani 30 May '08

30 May '08

Hello, As soon as i activate LDAP log system in syslog, the system does not respond...and many many logs is written in log. I stop syslog, system is up and running ok CentOS release 5 (Final) any idea ? thks, Alain

2 1

slurpd replication problmes
by Almir Karic 30 May '08

30 May '08

i'm trying to set up the repliacation with openldap 2.3 (using the one debian etch), when i add things to master everything is fine, it replicates it to slave just fine, on the other hand when i add things to slave it simply writes it to it's own tree. here is slapd.conf of the slave (stripped of any comments): include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_bdb sizelimit 500 tool-threads 1 backend bdb checkpoint 512 30 TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /etc/ldap/cacert.pem TLSCertificateFile /etc/ldap/servercrt.pem TLSCertificateKeyFile /etc/ldap/serverkey.pem loglevel stats database bdb suffix "dc=kiberpipa,dc=org" directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass eq lastmod on access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=kiberpipa,dc=org" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=kiberpipa,dc=org" write by * read updatedn "cn=admin,dc=kiberpipa,dc=org" updateref "ldaps://chat.kiberpipa.org:636" with this command "ldapadd -d 65535 -WxD 'cn=admin,dc=kiberpipa,dc=org' -f /tmp/b00" (on slave) i'm getting http://static.kiberpipa.org/~redduck666/local_adding.txt with "ldapadd -d 65535 -WxD 'cn=admin,dc=kiberpipa,dc=org' -f /tmp/b00 -H ldaps://chat.kiberpipa.org:636" i get http://static.kiberpipa.org/~redduck666/add_to_master.txt (passing it the same password they write to i have seen the certificate error there, if i change the ldap.conf on slave to point to ldap:// instead of ldaps:// that error goes away, however it still doesn't touch master. i also read i really shouldn't set updatedn to be the same as rootdn, well, tried changing it and granting full priviledges to the newly created account, no difference any pointers appreciated :-) -- For far too long, power has been concentrated in the hands of "root" and his "wheel" oligarchy. We have instituted a dictatorship of the users. All system administration functions will be handled by the People's Committee for Democratically Organizing the System (PC-DOS).

2 1

Multithreaded LDAP client
by Rakesh Yadav 30 May '08

30 May '08

Hi, LDAP version: openldap-2.3.38 I want to write multithreaded ldap client but don't have any idea about multithreaded ldap client. I have seen somewhere a sample code for multithreaded client but it is having some structures which r available only on Solaris. struct ldap_thread_fns : available on Solaris but not present in linux Please give me a solution for writting a multithreaded client on linux .. waiting for reply Thanks -- Rakesh Yadav Pune.

1 0

Password management question
by daniel rahmeh 29 May '08

29 May '08

hi, I have a question about the password management. As i know, it is possible to use hach functions into openLDAP, for exemple: password-hash {CRYPT} password-crypt-salt-format "$1$somesalt$" my question is about the compatibility with applications. today, we have some applications that uses openLDAP to create and authenticate users. Is there a way to say to openLDAP to hash received userPassword before inserting it into his database? exemple: imagine an application (application1) that wants to insert a new record (user account) in a openLDAP directory. Application1 doesn't know how to hash a password, is there a way to say to openLDAP to hash this password before adding the entry. application1 ----------userPassword: testpasswd-----> openLDAP (hash(testpasswd))------------->bdb ({CRYPT}$1$salt$EdFRTTT.BNHH. the goal is to make openLDAP manage the hashing process and avoid to patch the applications thank you

3 4

ldap_sasl_bind_s
by Gavin Henry 27 May '08

27 May '08

Hi All, I've been debugging the RealTime Asterisk LDAP driver, namely the function: static int ldap_reconnect(void) { int bind_result = 0; struct berval cred; if (ldapConn) { ast_debug(2, "Everything seems fine.\n"); return 1; } if (ast_strlen_zero(url)) { ast_log(LOG_ERROR, "Not enough parameters to connect to ldap database\n"); return 0; } if (LDAP_SUCCESS != ldap_initialize(&ldapConn, url)) { ast_log(LOG_ERROR, "Failed to init ldap connection to '%s'. Check debug for more info.\n", url); return 0; } if (LDAP_OPT_SUCCESS != ldap_set_option(ldapConn, LDAP_OPT_PROTOCOL_VERSION, &version)) { ast_log(LOG_WARNING, "Unable to set LDAP protocol version to %d, falling back to default.\n", version); } if (!ast_strlen_zero(user)) { ast_debug(2, "bind to '%s' as user '%s'\n", url, user); cred.bv_val = (char *) pass; cred.bv_len = strlen(pass); bind_result = ldap_sasl_bind_s(ldapConn, user, LDAP_SASL_SIMPLE, &cred, NULL, NULL, NULL); } else { ast_debug(2, "bind %s anonymously\n", url); bind_result = ldap_sasl_bind_s(ldapConn, "", LDAP_SASL_SIMPLE, NULL, NULL, NULL, NULL); } if (bind_result == LDAP_SUCCESS) { ast_debug(2, "Successfully connected to database.\n"); connect_time = time(NULL); return 1; } else { ast_log(LOG_WARNING, "bind failed: %s\n", ldap_err2string(bind_result)); ldap_unbind_ext_s(ldapConn, NULL, NULL); ldapConn = NULL; return 0; } } The line: bind_result = ldap_sasl_bind_s(ldapConn, NULL, LDAP_SASL_SIMPLE, NULL, NULL, NULL, NULL); is giving: May 26 14:52:03 asterisk slapd[30075]: conn=1 fd=12 ACCEPT from IP=127.0.0.1:57926 (IP=0.0.0.0:389) May 26 14:52:03 asterisk slapd[30075]: bind: ber_scanf failed May 26 14:52:03 asterisk slapd[30075]: conn=1 op=0 DISCONNECT tag=120 err=2 text=decoding error May 26 14:52:03 asterisk slapd[30075]: conn=1 fd=12 closed (operations error) Any debug tips would be greatly appreciated. Two different libldap have been tested (Centos 5.1 package and Symas OpenLDAP Devel package): openldap-devel-2.3.27-8.el5_1.3 cdsdevel-3.9-2 Thanks. -- Kind Regards, Gavin Henry. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, Aberdeenshire, AB51 4FP.

3 4

ldap database backend vs requests
by Ricardo Moreira 26 May '08

26 May '08

Hi there, I would like to know if in a database backend it's possible to know the request binded DN at on the search call? What I want is to build a wrapper database backend and integrate LDAP protocol with the private protocol used on the backend authentication/authorization system at my work. Our backend system deals with authentication/authorization and search in one request, usually our request is composed of: user + pass + input parameters + atributes (to be returned). I appreaciate any help! Regards, -- :: Ricardo Moreira

2 1

[Fwd: 2 identical names in address book]
by Thomas De Reyck 23 May '08

23 May '08

Hello, I am not sure if this is the correct place to ask this kind of information, so if I am mistaken, I apologize.. I am quite new to LDAP, however I have used some applications that require it and am now a semi-decent openLDAP administrator. So, as a next step, I am trying to program an address book with an LDAP backend. I have noticed that usually the cn is used as a dn when working with address book entries. This seems to lead to an interesting conflict which I need to resolve before I begin to program: What can be done when one has to import 2 people with an identical name? This seems to be irrelevant, since the chances of an identical name are small, but I for one know 2 people with the same first and last ames. Lets face it: names are not MD5 hashes ;-).. I guess someone must have thought this over before.. how oes one resolve this problem cleanly? Does one use another property? f so, which one? I am aware that this might be a very silly question, but I have een wondering about this for a few days now and google doesn't eem to satisfy my need for a solution.. :-). Thanks in advance, Thomas De Reyck

2 2

n-way multi master setup
by Joshua Miller 23 May '08

23 May '08

Good morning, I am attempting to follow the admin guide in setting up n-way multi-master replication. re: http://www.openldap.org/doc/admin24/replication.html#N-Way%20Multi-Master I'm running OpenLDAP 2.4.7, from Buchan Milne's RPMs, DB 4.6 on CentOS 5.1. I have setup a working directory on both nodes, then removed all data to start fresh, converting my slapd.conf to a slapd.d with slaptest. ie, # /etc/init.d/ldap stop # rm -rf /var/lib/ldap/* # slaptest -f slapd.conf -F slapd.d # /etc/init.d/ldap start Since I already had cn=config setup from my slapd.conf file, I skipped that part of the admin guide's instructions. I then modified the directory with the following LDIF, replacing the URI and credential values with my environment specific ones: dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 ldap://ldapserver1 olcServerID: 2 ldap://ldapserver2 dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://ldapserver2 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=002 provider=ldap://ldapserver1 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 - add: olcMirrorMode olcMirrorMode: TRUE I received no errors on running the modify command to add the changes from this LDIF. I then attempted to make a change and have it replicated, very simple to start with, using the following LDIF: dn: cn=config changetype: modify replace: olcSecurity olcSecurity: ssf=256 Once I successfully made this change on ldapserver1, I received the following errors in the logs of ldapserver2 (continuously repeating): ldapserver2 slapd2.4[12172]: conn=15 op=0 EXT oid=1.3.6.1.4.1.1466.20037 ldapserver2 slapd2.4[12172]: conn=15 op=0 STARTTLS ldapserver2 slapd2.4[12172]: conn=15 op=0 RESULT oid= err=0 text= ldapserver2 slapd2.4[12172]: conn=15 fd=17 ACCEPT from IP=10.12.2.25:4174 (IP=0.0.0.0:389) ldapserver2 slapd2.4[12172]: conn=15 fd=17 TLS established tls_ssf=256 ssf=256 ldapserver2 slapd2.4[12172]: conn=15 op=1 BIND dn="cn=config" method=128 ldapserver2 slapd2.4[12172]: conn=15 op=1 BIND dn="cn=config" mech=SIMPLE ssf=0 ldapserver2 slapd2.4[12172]: conn=15 op=1 RESULT tag=97 err=0 text= ldapserver2 slapd2.4[12172]: conn=15 op=2 SRCH base="cn=config" scope=2 deref=0 filter="(cn=config)" ldapserver2 slapd2.4[12172]: conn=15 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= ldapserver2 slapd2.4[12172]: conn=15 op=3 UNBIND ldapserver2 slapd2.4[12172]: conn=15 fd=17 closed ldapserver2 slapd2.4[12172]: olcServerID: value #1: <olcServerID> unknown factor <80>A<C2> ldapserver2 slapd2.4[12172]: olcServerID: value #1: <olcServerID> unknown factor <D0>A<C2> ldapserver2 slapd2.4[12172]: null_callback : error code 0x50 ldapserver2 slapd2.4[12172]: syncrepl_entry: rid=002 be_modify failed (80) ldapserver2 slapd2.4[12172]: do_syncrepl: rid=002 retrying (4 retries left) ldapserver2 slapd2.4[12172]: olcServerID: value #1: <olcServerID> unknown factor ldapserver2 slapd2.4[12172]: olcServerID: value #1: <olcServerID> unknown factor ldapserver2 slapd2.4[12172]: null_callback : error code 0x50 Any idea what I may have done wrong here? Thanks! Josh Miller, RHCE

5 6

Remote LDAP servers and parallel queries
by Julien Cassignol 21 May '08

21 May '08

Hi, I recently tried to build a setup as follows : Tree : dc=mycompany,dc=com Subtree 1 : dc=subtree1,dc=mycompany,dc=com Subtree 2 : dc=subtree2,dc=mycompany,dc=com Assuming that my needs are to store subtrees 1 and 2 in separate and remote LDAP servers, I used the LDAP backend. It worked pretty fine, and then I tried to check what was the behaviour if a link went down, or a remote server was unavailable. Testing, I saw that if I have a 10 seconds timeout for each server, if they're both down, my server spends 20 seconds waiting for the timeouts. I assume that's because the queries are done sequentially and not in parallel. Is there any way to be able to parallelize the queries and build a "buffer" for each remote backend in order to reconstruct it later, allowing a user not only to use each remote server, but also to find which subtree a user belongs to, without having those kind of problems ? My test case is pretty simple, but as the final implementation I want to build involves a lot more remote LDAP servers, and as I can't modify the architecture, I'm wondering what are the available solutions. Thanks, -- Julien Cassignol

1 0

OpenSSL clients connect over TLS, GnuTLS clients cannot.
by Ben Goldsbury 20 May '08

20 May '08

Hello, I'm having a problem getting TLS connections working properly when clients of the server are built against GnuTLS. When clients are built against OpenSSL, TLS connections work properly. If OpenLDAP is built against GnuTLS, TLS connections fail with this error (some debug included): TLS: peer cert untrusted or revoked (0x42) ldap_err2string ldap_start_tls: Connect error (-11) For testing, I've tried the following setups. Each use the same configuration: GnuTLS (client) -> GnuTLS (server) = failure OpenSSL (client) -> GnuTLS (server) = success GnuTLS (client) -> OpenSSL (server) = failure OpenSSL (client) -> OpenSSL (server) = success Also, I have used GnuTLS's testing tools (gnutls-serv and gnutls-cli) to verify that GnuTLS is working properly with the certificate. gnutls-serv \ --x509certfile /etc/ssl/my_ssl/server.key \ --x509keyfile /etc/ssl/my_ssl/server.crt gnutls-cli \ --x509cafile /etc/ssl/certs/ca-certificates.crt \ -p 5556 \ ldapserver.mydomain.com GnuTLS output: - Peer's certificate is trusted - Version: TLS1.1 - Key Exchange: DHE-RSA - Cipher: AES-128-CBC - MAC: SHA1 - Compression: NULL - Handshake was completed Versions used: GnuTLS 2.2.1 OpenSSL 0.9.8c OpenLDAP 2.4.9 Does anyone have any ideas whats going on, or any idea how to troubleshoot this further? Is this something that should go to the openldap-bugs mailing list? Thank you.

2 1

tls issues with clients
by Kyle Corupe 20 May '08

20 May '08

I'm pretty confused, because my clients are setup with almost identical configs, and the server(localhost), and one of my client PC's can connect and use SSL (ldapsearch -H ldaps://heracross.corpedia.internal/ -b dc=corpedia,dc=internal -x -Z), and it returns the correct results, and I can see it using TLS in the slapd log. I copied the same configs to both boxes /etc/ldap.conf ---- #host heracross.corpedia.internal base dc=corpedia,dc=internal uri heracross.corpedia.internalheracross.corpedia.internal ldap://heracross.corpedia.internal/ binddn cn=root,dc=corpedia,dc=internal bindpw ***************** scope sub bind_policy hard nss_base_passwd dc=corpedia,dc=internal?sub nss_base_shadow dc=corpedia,dc=internal?sub nss_base_group dc=corpedia,dc=internal?sub pam_password md5 ssl yes tls_cacertdir /etc/openldap/cacerts ----- I see the following in my slapd error log as I connect as one of the nonworking boxes root@kyle-laptop:/etc/ldap# ldapsearch -H ldaps://heracross.corpedia.internal/ -b dc=corpedia,dc=internal -x -Z ldap_start_tls: Can't contact LDAP server (-1) ldap_bind: Can't contact LDAP server (-1) ----- connection_get(14): got connid=25 connection_read(14): checking for input on id=25 TLS trace: SSL_accept:before/accept initialization TLS: can't accept. connection_read(14): TLS accept failure error=-1 id=25, closing connection_closing: readying conn=25 sd=14 for close connection_close: conn=25 sd=14 ----- Here is a nopaste link for my slapd.conf file http://rafb.net/p/NHjV1a33.html -- Kyle Corupe Unix Administrator Corpedia Corporation 2020 North Central Avenue, Suite 1050 Phoenix, Arizona 85004-4576 Desk:(602)443-2148 Cell: (623)261-2874 kcorupe(a)corpedia.com

3 4

Help with ACL's for userPassword updates
by Martin Benson 20 May '08

20 May '08

Hi I need some help with the Access Control Lists in my slapd.conf file. I need to allow myself to update a user's password for when they forget their password. With no ACL's in place I can do this using a ldapmodify command that authenticates as "cn=Manager,dc=example,dc=com". I normally have the following in my ACL's: access to attrs=userPassword by self write by anonymous auth by * none access to * by * read What do I need to do to change this to allow the manager to change the userPassword attribute. Thanks Martin Benson

2 1

ldap automount maps loading problem
by Rodrigo Castro 20 May '08

20 May '08

Can anyone tell me what's wrong with the following? May 20 08:59:08 localhost automount[20128]: starting automounter version 4.1.4, path = /home, maptype = ldap, mapname = squid.prof.inf.ufes.br: ou=auto.home,o=inf.ufes.br May 20 08:59:08 localhost automount[20128]: lookup(ldap): server = " squid.prof.inf.ufes.br", port = 389, base dn = "ou=auto.home,o=inf.ufes.br" May 20 08:59:08 localhost automount[20128]: mount(bind): bind_works = 1 May 20 08:59:08 localhost automount[20128]: using kernel protocol version 4.07 May 20 08:59:08 localhost automount[20128]: using timeout 300 seconds; freq 75 secs May 20 08:59:08 localhost automount[20128]: lookup(ldap): searching for "(objectclass=nisObject)" under "ou=auto.home,o=inf.ufes.br" May 20 08:59:08 localhost automount[20128]: lookup(ldap): query succeeded, no matches for (objectclass=nisObject) May 20 08:59:08 localhost automount[20128]: lookup(ldap): searching for "(objectclass=automount)" under "ou=auto.home,o=inf.ufes.br" May 20 08:59:08 localhost automount[20128]: lookup(ldap): examining entries May 20 08:59:08 localhost automount[20128]: lookup(ldap): done updating map May 20 08:59:08 localhost automount[20128]: failed to load map, exiting May 20 08:59:08 localhost automount[20128]: rm_unwanted: /home May 20 08:59:08 localhost automount[20128]: umount_multi: path=/home incl=0 May 20 08:59:08 localhost automount[20128]: umount_multi: no mounts found under /home Here's a part of my ldif: dn: ou=auto.master,o=inf.ufes.br objectClass: top objectClass: automountMap ou: auto.master dn: ou=auto.home,o=inf.ufes.br objectClass: top objectClass: automountMap ou: auto.home dn: cn=/,ou=auto.home,o=inf.ufes.br objectClass: automount cn: / automountInformation: -fstype=nfs,hard,intr,nodev squid.prof.inf.ufes.br: /home/& dn: cn=/home,ou=auto.master,o=inf.ufes.br objectClass: automount cn: /home automountInformation: ldap squid.prof.inf.ufes.br:ou=auto.home,o=inf.ufes.br -- __________________________________ Rodrigo de Castro Cosme Ciência da Computação - Universidade Federal do Espírito Santo Suporte mailing list - suporte(a)inf.ufes.br MSN - rdccosmo(a)gmail.com

1 0

AW: Help with ACL's for userPassword updates
by Kick, Claus 20 May '08

20 May '08

Hello Martin, The rootdn can always change everything everywhere. So, I guess you should use the root dn to do that. You ACL simply says that only the user himself/herself can change the password. Best regards, Claus ________________________________ Von: openldap-technical-bounces+claus.kick=siemens.com(a)OpenLDAP.org [mailto:openldap-technical-bounces+claus.kick=siemens.com@OpenLDAP.org] Im Auftrag von Martin Benson Gesendet: Sonntag, 18. Mai 2008 20:17 An: openldap-technical(a)openldap.org Betreff: Help with ACL's for userPassword updates Hi I need some help with the Access Control Lists in my slapd.conf file. I need to allow myself to update a user's password for when they forget their password. With no ACL's in place I can do this using a ldapmodify command that authenticates as "cn=Manager,dc=example,dc=com". I normally have the following in my ACL's: access to attrs=userPassword by self write by anonymous auth by * none access to * by * read What do I need to do to change this to allow the manager to change the userPassword attribute. Thanks Martin Benson

1 0

slapo-chain - can't get it working
by Richard Nelson 19 May '08

19 May '08

I sent this two days ago, from an unsubscribed account and it still hasn't shown up... don't know if moderation is hampered, or if it just didn't make through... I have the basics covered - 1 master, 4 syncrepl slaves (going to 2-3 MM, 1-2 slaves). This setup has been working quite well - supporting AIX, Linux user data, Samba PDC/BDCs, and Kerberos (slapd 2.4.7 Debian Sid/unstable) The only issue I have now, is having to find the master to perform any updates. I'd like to use slapo-chain so that update referrals are automatically handled, especially since so little stuff supports referrals - even things that should. There are a few examples here and there, and unfortunately, some of them contradict others (probably written to different ldap levels). As an example of my plight, here is the output of ldappasswd on a slave machine (ldapmodify shows the same issue, but isn't as easy to show) # # on the slave, when trying a ldappasswd: $ ldappasswd -Ydigest-md5 -w<my passwd> SASL/DIGEST-MD5 authentication started SASL username: renegade SASL SSF: 128 SASL data security layer installed. Result: Referral (10) Referral: ldap://ldap-master.cobpli.svl.ibm.com # # The following is the slave ldap trace, and there is *no* traffic to the master... conn=0 op=1 BIND authcid="renegade(a)COBPLI.SVL.IBM.COM" authzid="renegade(a)COBPLI.SVL.IBM.COM" conn=0 op=1 BIND dn="uid=renegade,ou=users,dc=cobpli,dc=svl,dc=ibm,dc=com" mech=DIGEST-MD5 sasl_ssf=128 ssf=128 conn=0 op=1 RESULT tag=97 err=0 text= conn=0 op=2 EXT oid=1.3.6.1.4.1.4203.1.11.1 conn=0 op=2 PASSMOD conn=0 op=2 RESULT oid= err=10 text= # # The basics work: $ ldapwhoami SASL/GSSAPI authentication started SASL username: renegade(a)COBPLI.SVL.IBM.COM SASL SSF: 56 SASL data security layer installed. dn:uid=renegade,ou=users,dc=cobpli,dc=svl,dc=ibm,dc=com # # Proxy authentication works: $ ldapwhoami -Uproxy -Ydigest-md5 -w<passwd> -Xu:cowboy SASL/DIGEST-MD5 authentication started SASL username: u:cowboy SASL SSF: 128 SASL data security layer installed. dn:uid=cowboy,ou=users,dc=cobpli,dc=svl,dc=ibm,dc=com # # Here is the likely relevant ldap sections (chain overlay, syncprop, updatref): # overlay chain chain-uri "ldap://ldap-master.cobpli.svl.ibm.com/" # Neither of these lines make a difference chain-rebind-as-user TRUE #chain-rebind-as-user FALSE # Here, I've tried simple/sasl, varied saslmech, etc... chain-idassert-bind bindmethod="simple" saslmech=digest-md5 authz=proxyauthz binddn="uid=proxy,ou=users,dc=cobpli,dc=svl,dc=ibm,dc=com" credentials="<passwd>" mode=self chain-idassert-authzFrom "*" syncrepl rid=1 provider=ldap://ldap-master.cobpli.svl.ibm.com/ starttls=no binddn="cn=Replicator,ou=DSA,dc=cobpli,dc=svl,dc=ibm,dc=com" bindmethod=simple credentials=<passwd> searchbase="dc=cobpli,dc=svl,dc=ibm,dc=com" schemaChecking=off type=refreshAndPersist retry="10 10 300 +" updateref ldap://ldap-master.cobpli.svl.ibm.com/

5 10

global email address
by J. Manuel Velasco - UBILIBET 19 May '08

19 May '08

Hello, I am using postfix with ldap. There is one special emaill address called tots(a)ubilibet.com to send mails for everybody, but two nre users I added don't receive mails from this address. I have checked the configuration of ldap to other users and postfix aliases, but i can't see anything regarding to this email address. What can i check more, please ? Thanks in advance. --

1 0

OpenLDAP + Kerberos = Crash?
by Andrew Wiley 18 May '08

18 May '08

I sent this twice before realizing I was sending from another email address that isn't on the list. I don't know if emails from non-subscribers are moderated or just dropped, but in any case, I'm very sorry if those emails show up on the list as duplicates. I'm trying to get a setup of Kerberos and LDAP working. LDAP works fine with plain authentication and everything seems to be set up correctly, but when I try to use GSSAPI authentication, slapd crashes. Application Versions: openldap 2.3.40 heimdal 1.0.1 Server log from startup to crash: May 17 21:50:07 Lagbox slapd[11161]: @(#) $OpenLDAP: slapd 2.3.40 (Jan 15 2008 23:41:27) $ nobody@tk-gwa:/build/src/openldap-2.3.40/servers/slapd May 17 21:50:07 Lagbox slapd[11161]: /etc/openldap/slapd.conf: line 139: "attr" is deprecated (and undocumented); use "attrs" instead. May 17 21:50:07 Lagbox slapd[11161]: /etc/openldap/slapd.conf: line 144: "attr" is deprecated (and undocumented); use "attrs" instead. May 17 21:50:07 Lagbox slapd[11162]: bdb_db_open: unclean shutdown detected; attempting recovery. May 17 21:50:07 Lagbox slapd[11162]: bdb_db_open: Warning - No DB_CONFIG file found in directory /var/lib/openldap/openldap-data: (2) Expect poor performance for suffix dc=wileynetworks,dc=org. May 17 21:50:07 Lagbox slapd[11162]: slapd starting May 17 21:51:04 Lagbox slapd[11162]: conn=0 fd=14 ACCEPT from IP= 127.0.0.1:54066 (IP=0.0.0.0:389) May 17 21:51:04 Lagbox slapd[11162]: conn=0 op=0 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" May 17 21:51:04 Lagbox slapd[11162]: conn=0 op=0 SRCH attr=supportedSASLMechanisms May 17 21:51:04 Lagbox slapd[11162]: conn=0 op=0 SEARCH RESULT tag=101 err=0 nentries=1 text= May 17 21:51:04 Lagbox slapd[11162]: conn=0 op=1 BIND dn="" method=163 May 17 21:51:05 Lagbox slapd[11162]: conn=0 op=1 RESULT tag=97 err=14 text= May 17 21:51:05 Lagbox slapd[11162]: conn=0 op=2 BIND dn="" method=163 May 17 21:51:05 Lagbox slapd[11162]: conn=0 op=2 RESULT tag=97 err=14 text= May 17 21:51:05 Lagbox slapd[11162]: conn=0 op=3 BIND dn="" method=163 May 17 21:51:05 Lagbox slapd[11165] general protection eip:b7abeb05 esp:b6c80df0 error:0 Search command that causes crash: [arew264@Lagbox ~]$ ldapsearch -H ldap://localhost/ -b dc=wileynetworks,dc=org SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) [arew264@Lagbox ~]$ Attached: slapd.conf Note: I am leaving all names intact here because this is a test setup and not any sort of production server. The user that ran the search command is in kerberos and had run kinit and gotten a ticket before running the search. With just a crash and no error messages, I don't know where to start in tracking this down. Andrew Wiley

1 0

openldap and heimdal persistent connection
by Brian Thompson 18 May '08

18 May '08

Hello, We're currently running openldap 2.2.20 with the back-hdb ldap backend. It's being used as a proxy to forward ldapi queries from heimdal 0.6.3's ldap backend to a Sun Directory Server 5.2 which doesn't natively support ldapi. It seems that the connection is persistent such that restarting the Sun Directory Server requires us to then restart openldap in order to make heimdal work properly again. Is there any way around this so that openldap doesn't require restarting each time someone restarts the Sun dierctory? Thanks for any info. -Brian

2 1

Re: Lgoin failed if URI in client's ldap.conf is used
by Luke Lee 17 May '08

17 May '08

I corrected the typo but the problem persists. If I use the HOST directive, the problem appears to go away. What else shall I check? Please advice. Thanks. Luke ----- Original Message ---- From: Pierangelo Masarati <ando(a)sys-net.it> To: Luke Lee <leeluke77(a)yahoo.com> Cc: openldap-technical(a)openldap.org Sent: Friday, May 16, 2008 2:52:22 PM Subject: Re: Lgoin failed if URI in client's ldap.conf is used > I am running OpenLDAP 2.3.39 on a RedHat server. I am encountering a user > ssh login failure on an LDAP client if I use the URI based way to specify > the LDAP servers in the client's /etc/ldap.conf and > /etc/openldap/ldap.conf files. I don't have such a problem if I use the > host based way. A snip of the configurations and the ldap.log on the ldapm > is the following: > /etc/ldap.conf: > uri ldap://ldapm.mydomain.com ldap://ldapsl.mydomain.com > /etc/openldap/ldap.conf: > URI ldap://ldapm.mydomain.com ldap://ldapsl..mydomain.com There's probably a typo in the last URI above; don't know if it's related to your issue, though > May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: > cn=admin,dc=mydomain,dc=com > May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: * > May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [4] applying read(=rscxd) > (stop) > May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [4] mask: read(=rscxd) > May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access granted > by read(=rscxd) > May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access to > "uid=luke_l,ou=People,dc=mydomain,dc=com" "uid" requested > May 16 14:16:33 ldapm slapd[27604]: => acl_get: [2] attr uid > May 16 14:16:33 ldapm slapd[27604]: access_allowed: no res from state > (uid) > May 16 14:16:33 ldapm slapd[27604]: => acl_mask: access to entry > "uid=luke_l,ou=People,dc=mydomain,dc=com", attr "uid" requested > May 16 14:16:33 ldapm slapd[27604]: => acl_mask: to value by "", (=0) > May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: self > May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: > cn=admin,dc=mydomain,dc=com > May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: * > May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [4] applying read(=rscxd) > (stop) > May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [4] mask: read(=rscxd) > May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access granted > by read(=rscxd) > May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access to > "uid=luke_l,ou=People,dc=mydomain,dc=com" "userPassword" requested > May 16 14:16:33 ldapm slapd[27604]: => acl_get: [1] attr userPassword > May 16 14:16:33 ldapm slapd[27604]: access_allowed: no res from state > (userPassword) > May 16 14:16:33 ldapm slapd[27604]: => acl_mask: access to entry > "uid=luke_l,ou=People,dc=mydomain,dc=com", attr "userPassword" requested > May 16 14:16:33 ldapm slapd[27604]: => acl_mask: to value by "", (=0) > May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: self > May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: anonymous > May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [2] applying auth(=xd) > (stop) > May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [2] mask: auth(=xd) > May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access denied > by auth(=xd) > May 16 14:16:33 ldapm slapd[27604]: send_search_entry: conn 35 access to > attribute userPassword, value #0 not allowed You only have "auth" access to the userPassword attribute (which sounds reasonable) but the client is trying to "read" the password. I suspect a misconfiguration of the client, which tries to auth by internally comparing userPassword values instead of using an LDAP bind operation. > May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access to > "uid=luke_l,ou=People,dc=mydomain,dc=com" "shadowLastChange" requested > May 16 14:16:33 ldapm slapd[27604]: => acl_get: [2] attr shadowLastChange > May 16 14:16:33 ldapm slapd[27604]: access_allowed: no res from state > (shadowLastChange) > May 16 14:16:33 ldapm slapd[27604]: => acl_mask: access to entry > "uid=luke_l,ou=People,dc=mydomain,dc=com", attr "shadowLastChange" > requested > May 16 14:16:33 ldapm slapd[27604]: => acl_mask: to value by "", (=0) > May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: self > May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: > cn=admin,dc=mydomain,dc=com > May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: * > May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [4] applying read(=rscxd) > (stop) > May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [4] mask: read(=rscxd) > May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access granted > by read(=rscxd) > > Can anyone please help resolve the above problem? Thanks a lot! p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati(a)sys-net.it ---------------------------------------

1 0

Lgoin failed if URI in client's ldap.conf is used
by Luke Lee 16 May '08

16 May '08

I am running OpenLDAP 2.3.39 on a RedHat server. I am encountering a user ssh login failure on an LDAP client if I use the URI based way to specify the LDAP servers in the client's /etc/ldap.conf and /etc/openldap/ldap.conf files. I don't have such a problem if I use the host based way. A snip of the configurations and the ldap.log on the ldapm is the following: /etc/ldap.conf: uri ldap://ldapm.mydomain.com ldap://ldapsl.mydomain.com /etc/openldap/ldap.conf: URI ldap://ldapm.mydomain.com ldap://ldapsl..mydomain.com May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: cn=admin,dc=mydomain,dc=com May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: * May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [4] applying read(=rscxd) (stop) May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [4] mask: read(=rscxd) May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access granted by read(=rscxd) May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access to "uid=luke_l,ou=People,dc=mydomain,dc=com" "uid" requested May 16 14:16:33 ldapm slapd[27604]: => acl_get: [2] attr uid May 16 14:16:33 ldapm slapd[27604]: access_allowed: no res from state (uid) May 16 14:16:33 ldapm slapd[27604]: => acl_mask: access to entry "uid=luke_l,ou=People,dc=mydomain,dc=com", attr "uid" requested May 16 14:16:33 ldapm slapd[27604]: => acl_mask: to value by "", (=0) May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: self May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: cn=admin,dc=mydomain,dc=com May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: * May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [4] applying read(=rscxd) (stop) May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [4] mask: read(=rscxd) May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access granted by read(=rscxd) May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access to "uid=luke_l,ou=People,dc=mydomain,dc=com" "userPassword" requested May 16 14:16:33 ldapm slapd[27604]: => acl_get: [1] attr userPassword May 16 14:16:33 ldapm slapd[27604]: access_allowed: no res from state (userPassword) May 16 14:16:33 ldapm slapd[27604]: => acl_mask: access to entry "uid=luke_l,ou=People,dc=mydomain,dc=com", attr "userPassword" requested May 16 14:16:33 ldapm slapd[27604]: => acl_mask: to value by "", (=0) May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: self May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: anonymous May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [2] applying auth(=xd) (stop) May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [2] mask: auth(=xd) May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access denied by auth(=xd) May 16 14:16:33 ldapm slapd[27604]: send_search_entry: conn 35 access to attribute userPassword, value #0 not allowed May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access to "uid=luke_l,ou=People,dc=mydomain,dc=com" "shadowLastChange" requested May 16 14:16:33 ldapm slapd[27604]: => acl_get: [2] attr shadowLastChange May 16 14:16:33 ldapm slapd[27604]: access_allowed: no res from state (shadowLastChange) May 16 14:16:33 ldapm slapd[27604]: => acl_mask: access to entry "uid=luke_l,ou=People,dc=mydomain,dc=com", attr "shadowLastChange" requested May 16 14:16:33 ldapm slapd[27604]: => acl_mask: to value by "", (=0) May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: self May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: cn=admin,dc=mydomain,dc=com May 16 14:16:33 ldapm slapd[27604]: <= check a_dn_pat: * May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [4] applying read(=rscxd) (stop) May 16 14:16:33 ldapm slapd[27604]: <= acl_mask: [4] mask: read(=rscxd) May 16 14:16:33 ldapm slapd[27604]: => access_allowed: read access granted by read(=rscxd) Can anyone please help resolve the above problem? Thanks a lot! Luke

2 1

ldap - adding file from application to ldap
by Raghavendra Sangamesh 16 May '08

16 May '08

Hi I have installed openaldap And I am able to add default things to the bdb (database). I have used this link to install things and to add simple data http://www.devshed.com/c/a/Administration/Understanding-LDAP-part-2/1/ Now I am adding default things like this Here is my example.ldif file dn: dc=my-domain,dc=com objectclass: dcObject objectclass: organization o: MY DOMAIN COMPANY dc: my-domain dn: cn=Manager,dc=my-domain,dc=com objectclass: organizationalRole cn: Manager Now I am adding default things like this /usr/local/openldap/bin/ldapadd -x -D "cn=Manager,dc=my-domain,dc=com" -W -f my-domain.ldif Now I want to add from My CA simulator and retrive data . ie I have ca.ldif file I want to add this data to database, I am unable to do that. Here is the file that I want to add dn: cn=schema objectClass: top objectClass: ldapSubentry objectClass: subschema cn: schema attributeTypes: ( isrevoked-oid NAME 'isrevoked' SYNTAX 1.3.6.1.4.1.1466.115. 121.1.27 X-ORIGIN 'user defined' ) attributeTypes: ( cauid-oid NAME 'cauid' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' ) objectClasses: ( utscau-oid NAME 'utscau' SUP top STRUCTURAL MUST ( cauid $ is revoked ) X-ORIGIN 'user defined' ) nsSchemaCSN: 4632762e000000000000 I dnt to how to go about this , let me know for any solutions it would be great . I want to know how can I modify my slapd.conf to add this above file and retrive data. Thanks & Regards Raghavendra S Mascon Global Limited EMAIL DISCLAIMER : This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. Any unauthorised distribution or copying is strictly prohibited. If you receive this transmission in error, please notify the sender by reply email and then destroy the message. Opinions, conclusions and other information in this message that do not relate to official business of Mascon shall be understood to be neither given nor endorsed by Mascon. Any information contained in this email, when addressed to Mascon clients is subject to the terms and conditions in governing client contract. Whilst Mascon takes steps to prevent the transmission of viruses via e-mail, we can not guarantee that any email or attachment is free from computer viruses and you are strongly advised to undertake your own anti-virus precautions. Mascon grants no warranties regarding performance, use or quality of any e-mail or attachment and undertakes no liability for loss or damage, howsoever caused.

2 1

RES: Openldap 2.3.39 Password Policy
by Gustavo Mendes de Carvalho 16 May '08

16 May '08

Hi Venkata, Check where is your slapd binary. In this directory, you will see a libexec directory. Inside you can find ppolicy.la module. Execute a pwd command and put pwd output in your slapd.conf file Here is my slapd.conf file ####################################################################### # Global definitions ####################################################################### include /usr/local/ldap/servers/slapd/schema/core.schema include /usr/local/ldap/servers/slapd/schema/cosine.schema include /usr/local/ldap/servers/slapd/schema/inetorgperson.schema include /usr/local/ldap/servers/slapd/schema/misc.schema include /usr/local/ldap/servers/slapd/schema/nis.schema include /usr/local/ldap/servers/slapd/schema/ppolicy.schema pidfile /var/run/slapd.pid argsfile /var/run/slapd.args logfile /var/log/ldap.log loglevel 256 # Load dynamic backend modules: modulepath /usr/local/libexec/openldap ### moduleload back_ldap.la ### moduleload back_passwd.la moduleload accesslog.la ### moduleload pcache.la moduleload ppolicy.la moduleload unique.la ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "c=country" rootdn "cn=manager,c=country" rootpw {SSHA}password's hash directory /usr/local/var/openldap-data/ mode 0600 cachesize 1000000 checkpoint 256 60 overlay ppolicy ppolicy_default "cn=default,ou=policies,o=org,c=country" ####################################################################### # ACL's ####################################################################### access to attrs=userPassword by self write by anonymous auth by dn="cn=manager,c=country" write by * read access to * by self write by dn="cn=manager,c=country" write by * read ####################################################################### # Indexes ####################################################################### index objectClass eq,pres index uid,memberUid eq,pres,sub Another tip is remove your shadow parameters from your user accoount. I mean, when you create an account, unset shadow properties. Leave all shadow properties defined in ppolicy options. Check my user output dn: uid=sdanyluk,ou=orgunit,o=org,c=country objectClass: posixAccount objectClass: top objectClass: inetOrgPerson objectClass: person loginShell: /bin/bash givenName: Scott sn: Danyluk displayName: Scott Danyluk uid: sdanyluk homeDirectory: /home/sdanyluk cn: Scott Danyluk uidNumber: 14838 userPassword: xxxxxxxxxxxxxxxxxxxxxxx gidNumber: 25075 Regards --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com ________________________________ De: Venkata Janardhana [mailto:avjana@gmail.com] Enviada em: quinta-feira, 15 de maio de 2008 13:51 Para: jarbas.junior(a)gmail.com; gmcarvalho(a)gmail.com Cc: openldap-technical(a)openldap.org Assunto: Openldap 2.3.39 Password Policy, Hello , I see the you had same issue for the openldap 2.3.39 password policy. I am struggling to get this working like anything. Could you please help me out in configuring password policy and change the user password. I have installed openldap 2.3.39 and ./configure --prefix=/usr/local \ --libexecdir=/usr/sbin \ --sysconfdir=/etc \ --localstatedir=/srv/ldap \ --disable-debug \ --enable-dynamic \ --enable-crypt \ --enable-modules \ --enable-rlookups \ --enable-backends \ --enable-overlays \ --disable-sql && make depend && make make test su root -c 'make install I cannot find modulepath /usr/lib/openldap moduleload ppolicy.la files. Here is my slapd.conf and ldap search file hese are the following slapd.conf file and ldapsearch output.. User can login to the ldap server for the first time and could change the password but cannot login with new password or old password. having hard time in getting password policy working. COuld you some pls help me out.. whats the wrong.. thanks in advance, # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/ppolicy.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! access to amdexrs=userPassword by self write by * auth access to * by * read ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=sales,dc=amdex,dc=com" rootdn "cn=Manager,dc=sales,dc=amdex,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq ---------------------------------------------------------- [root@testserver06 openldap]# ldapsearch -x -b 'dc=sales,dc=amdex,dc=com' '(objectclass=*)' # extended LDIF # # LDAPv3 # base <dc=sales,dc=amdex,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # sales.amdex.com dn: dc=sales,dc=amdex,dc=com dc: sales objectClass: top objectClass: domain objectClass: domainRelatedObject associatedDomain: sales.amdex.com # People, sales.amdex.com dn: ou=People,dc=sales,dc=amdex,dc=com ou: People objectClass: top objectClass: organizationalUnit objectClass: domainRelatedObject associatedDomain: sales.amdex.com # Group, sales.amdex.com dn: ou=Group,dc=sales,dc=amdex,dc=com ou: Group objectClass: top objectClass: organizationalUnit objectClass: domainRelatedObject associatedDomain: sales.amdex.com # ja5199, Group, sales.amdex.com dn: cn=ja5199,ou=Group,dc=sales,dc=amdex,dc=com objectClass: posixGroup objectClass: top cn: ja5199 gidNumber: 609 # ja5199, People, sales.amdex.com dn: uid=ja5199,ou=People,dc=sales,dc=amdex,dc=com uid: ja5199 cn: Jana Avula givenName: Jana sn: Avula mail: ja5199(a)sales.amdex.com objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowLastChange: 14001 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 609 gidNumber: 609 homeDirectory: /home/ja5199 gecos: Jana Avula # Policies, sales.amdex.com dn: ou=Policies,dc=sales,dc=amdex,dc=com objectClass: top objectClass: organizationalUnit ou: Policies # default, Policies, sales.amdex.com dn: cn=default,ou=Policies,dc=sales,dc=amdex,dc=com objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdamdexribute: 2.5.4.35 pwdMaxAge: 15552000 pwdExpireWarning: 864000 pwdInHistory: 1 pwdCheckQuality: 0 pwdMinLength: 8 pwdMaxFailure: 4 pwdLockout: TRUE pwdLockoutDuration: 1920 pwdGraceAuthNLimit: 5 pwdFailureCountInterval: 0 pwdMustChange: TRUE pwdAllowUserChange: TRUE pwdSafeModify: TRUE # search result search: 2 result: 0 Success # numResponses: 8 # numEntries: 7

1 0

openldap and mysql authentication
by thom.laurent＠free.fr 15 May '08

15 May '08

Hi, I have a simple question... I want to use openldap as an address book, so it can be used with mail clients like thunderbird, outlook... I already have a mysql database to store users for my mail server, and I dont want to duplicate these informations. Can I use this sql database as a source for the openldap access control, or do I have to store all my users in the ldap ? This way I could authenticate using user accounts stored in the mysql database and keep all my contact informations in the ldap... Thanks for your answers!

2 1

"invalid structural object class chain"
by Karsten Kankowski 14 May '08

14 May '08

Dear wise guys! Sorry for a "newby" question: I would like to load following LDIF: dn: cn=Zaphod Beblebrox, ou=people,cu=user,cu=a-d,cu=natco,dc=cax,dc=airbus,dc=com cn: Zaphod Beblebrox objectClass:Top objectClass: Person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: account objectClass: posixAccount gidNumber: 42 homeDirectory: /home/ZZ-Plural-Z-Alpha userid:zaphod I get back: ldapadd: Object class violation (65) additional info: invalid structural object class chain (inetOrgPerson/account) I searched before I wrote this mal the Web/ the Forum / the FAQ / the admin-Guide :-) I found at the admin guide chapter C1.13 an description about this issue. BUT: I´m sorry! I don´t understand this real hard to read english. All what I hopfully know is, that a subsequent class of a Structural can be one or more auxiliary OR an other Structural. I assume that Top->Person->organizationalPerson->inetOrgperson "looks" like one structural class in case that they inherit via the SUP keyword ( called superclass ?? ) For that I do not understand why the account object class can´t be "connect" to that superclass. What´s wrong here and how do can I use the account as subsequent class of inetOrgPerson. The "connect" of posixAccount to account should be also possible. Thanks a lot for your help in advance, Karsten (Alien) -- //// Never forget your towel \\\\ *********************************************************** Karsten Kankowski on behalf of Computacenter Subcontractor for OADI Phone: +49 (0)40 743 74589 Fax: +49 (0)40 743 870 74589 Mailto:Karsten.Kankowski@airbus.com PgP-Key 0x754EEF1D ********************************************************** The information in this e-mail is confidential. The contents may not be disclosed or used by anyone other then the addressee. Access to this e-mail by anyone else is unauthorised. If you are not the intended recipient, please notify Airbus immediately and delete this e-mail. Airbus cannot accept any responsibility for the accuracy or completeness of this e-mail as it has been sent over public networks. If you have any concerns over the content of this message or its Accuracy or Integrity, please contact Airbus immediately. All outgoing e-mails from Airbus are checked using regularly updated virus scanning software but you should take whatever measures you deem to be appropriate to ensure that this message and any attachments are virus free.

2 1

password policy user configuration
by Gustavo Mendes de Carvalho 14 May '08

14 May '08

Hi there, I already compiled last openldap stable version with this commands # ./configure --program-prefix=/usr/local/ldap --enable-bdb --enable-modules --enable-overlays=yes --enable-backends=yes --disable-ipv6 --with-cyrus-sasl --with-tls --disable-sql # make depend; make; make install and after running make test command, I saw that everything was OK, so I can start slapd with ppolicy module included. When I include pwdPolicy objectclass in user configuration I can see several pwd parameters, but after set some values, I can't see this policy working. I mean, in my user bellow, I set "pwdInHistory = 6", but when I try to change their password, OpanLDAP do not check this value. Here is command used to change passwords ldappasswd -w test1234 -a test1234 -s 5432test -x -H ldap://192.168.248.164 -D uid=test,ou=orgunit,o=org ldappasswd -w 5432test -a 5432test -s test1234 -x -H ldap://192.168.248.164 -D uid=test,ou=orgunit,o=org I can execute this commands ad eternum, with no error messages from LDAP server telling me that my password is not OK. According with my configuration I would use 7 different passwords (6 in history +1 to change) And I can change this password faster than it expires (according with configuration bellow "pwdMinAge: 30" tells me to wait 30 seconds to change my password) User definition dn: uid=test,ou=orgunit,o=org objectClass: posixAccount objectClass: top objectClass: inetOrgPerson objectClass: shadowAccount objectClass: person objectClass: pwdPolicy loginShell: /bin/bash givenName: test sn: test-test displayName: test test-test uid: test homeDirectory: /home/test shadowFlag: 0 shadowMax: 35 shadowWarning: 7 shadowInactive: 99999 shadowExpire: 99999 cn: test test-test uidNumber: 12190 gidNumber: 25023 shadowMin: 10 pwdAttribute: userPassword pwdMinAge: 30 pwdMaxAge: 120 pwdInHistory: 3 pwdMinLength: 8 pwdExpireWarning: 60 pwdLockout: TRUE pwdLockoutDuration: 60 pwdMaxFailure: 2 pwdSafeModify: TRUE shadowLastChange: 14006 pwdMustChange: FALSE userPassword: {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Does anybody already uses this pwd definitions ann can explain me if is it OK ? I already read man 5 slapo-ppolicy and I already execute slapindex -v after insert this parameters either. Man 5 does explain all parameters, and I set up them according with man explanation, but it does no work. Thanks in advance --- Gustavo Mendes de Carvalho e-mail: gmcarvalho(a)gmail.com

3 5

LDAP server and Router Cisco VPN
by youness hsina 13 May '08

13 May '08

Hi all sorry for my english i have an ldap server and a router cisco vpn 3600 séries. i want to configure my router in order to use my ldapserver but i don't know how i cant do this. Have you any ideas please ? i join a picture of my network diagram. Regards, Uness

3 7

Just su doesn't work
by AlexanDER Franca 13 May '08

13 May '08

Hi. Sorry for my english... So... I have installed OpenLDAP and nss_ldap. I'm using Slackware 12. All works fine, I can search, add... getent works for passwd and group, etc. But if I run 'su - username', the 'username' is found but seems password never work. I receive a 'Sorry' from su. If I'm root and run 'su - username', all works fine... I become 'username' with my home directory, etc (id command show 'username' informations right too). It seems to be something with password configuration, but... I don't know... I have 3 or 4 users, all with the same password. I tried all of them, and... the same problem. I tried 3 "encryption" modes (md5, md5crypt and clear). I was change /etc/login.defs to disable MD5_CRYPT_ENABLE, enable again... and nothing works. /var/log/debug show no errors. I don't asking for a solution, just a way to still searching (I don't know where to go now). []'s Alexander Brazil - Rio de Janeiro

3 4

Re: Mystery - Authentication Would Fail If Not Binding With Server By Using cn=Manager
by Luke Lee 13 May '08

13 May '08

I just resolved the problem myself. I think the slapd was confused by some "commented out" access entries (access entries with a pound sign to being with). I removed those entries and the problem just went away. Thank you for taking time and trying to help. Luke ----- Original Message ---- From: Luke Lee <leeluke77(a)yahoo.com> To: Dieter Kluenter <dieter(a)dkluenter.de>; openldap-technical(a)openldap.org Sent: Monday, May 12, 2008 10:56:00 AM Subject: Mystery - Authentication Would Fail If Not Binding With Server By Using cn=Manager My access rules in the slapd..conf are the following: access to attrs=userPassword by self write by anonymous auth by dn.base="cn=sysadmin,dc=mydomain,dc=com" write by group.exact="cn=itmanager,ou=manager,dc=mydomain,dc=com" write by * none access to * by self write by dn.base="cn=sysadmin,dc=mydomain,dc=com" write by group.exact="cn=itmanager,ou=manager,dc=mydomain,dc=com" write by * read If I don't have the following entries in a client's /etc/ldap.conf, when I login the client by using ssh I will get the "Access denied" message: binddn cn=Manager,dc=mydomain,dc=com bindpw secret The ldap log is the following: May 11 16:08:18 ldapm slapd[24629]: conn=0 fd=13 ACCEPT from IP=192.168.2.161:33801 (IP=0.0.0.0:389) May 11 16:08:18 ldapm slapd[24629]: conn=0 op=0 BIND dn="" method=128 May 11 16:08:18 ldapm slapd[24629]: conn=0 op=0 RESULT tag=97 err=0 text= May 11 16:08:18 ldapm slapd[24629]: conn=0 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=luke_l))" May 11 16:08:18 ldapm slapd[24629]: conn=0 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 16:08:18 ldapm slapd[24629]: conn=0 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= May 11 16:08:23 ldapm slapd[24629]: conn=0 op=2 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=luke_l))" May 11 16:08:23 ldapm slapd[24629]: conn=0 op=2 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 16:08:23 ldapm slapd[24629]: conn=0 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text= May 11 16:08:23 ldapm slapd[24629]: conn=1 fd=16 ACCEPT from IP=192.168.2.161:33802 (IP=0.0.0.0:389) May 11 16:08:23 ldapm slapd[24629]: conn=1 op=0 BIND dn="" method=128 May 11 16:08:23 ldapm slapd[24629]: conn=1 op=0 RESULT tag=97 err=0 text= May 11 16:08:23 ldapm slapd[24629]: conn=1 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(uid=luke_l)" May 11 16:08:23 ldapm slapd[24629]: conn=1 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= If I have the binddn and bindpw using the distinguished name, Manager, the login will succeed. The ldap log is the following: May 11 17:22:32 ldapm slapd[24629]: conn=20 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=20 op=4 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(uid=luke_l)" May 11 17:22:32 ldapm slapd[24629]: conn=20 op=4 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=20 op=5 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup)(|(memberUid=luke_l)(uniqueMember=uid=luke_l,ou=people,dc=mydomain,dc=com)))" May 11 17:22:32 ldapm slapd[24629]: conn=20 op=5 SRCH attr=cn userPassword memberUid uniqueMember gidNumber May 11 17:22:32 ldapm slapd[24629]: <= bdb_equality_candidates: (uniqueMember) not indexed May 11 17:22:32 ldapm slapd[24629]: conn=20 op=5 SEARCH RESULT tag=101 err=0 nentries=0 text= May 11 17:22:32 ldapm slapd[24629]: conn=20 op=6 UNBIND May 11 17:22:32 ldapm slapd[24629]: conn=20 fd=18 closed May 11 17:22:32 ldapm slapd[24629]: conn=21 fd=16 ACCEPT from IP=192.168.2.161:33816 (IP=0.0.0.0:389) May 11 17:22:32 ldapm slapd[24629]: conn=21 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" method=118 May 11 17:22:32 ldapm slapd[24629]: conn=21 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" mech=SIMPLE ssf=0 May 11 17:22:32 ldapm slapd[24629]: conn=21 op=0 RESULT tag=97 err=0 text= May 11 17:22:32 ldapm slapd[24629]: conn=21 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=10022))" May 11 17:22:32 ldapm slapd[24629]: conn=21 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 17:22:32 ldapm slapd[24629]: conn=21 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=18 op=6 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=luke_l))" May 11 17:22:32 ldapm slapd[24629]: conn=18 op=6 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 17:22:32 ldapm slapd[24629]: conn=18 op=6 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=22 fd=18 ACCEPT from IP=192.168.2.161:33817 (IP=0.0.0.0:389) May 11 17:22:32 ldapm slapd[24629]: conn=22 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" method=118 May 11 17:22:32 ldapm slapd[24629]: conn=22 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" mech=SIMPLE ssf=0 May 11 17:22:32 ldapm slapd[24629]: conn=22 op=0 RESULT tag=97 err=0 text= May 11 17:22:32 ldapm slapd[24629]: conn=22 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=10022))" May 11 17:22:32 ldapm slapd[24629]: conn=22 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 17:22:32 ldapm slapd[24629]: conn=22 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=23 fd=20 ACCEPT from IP=192.168.2.161:33818 (IP=0.0.0.0:389) May 11 17:22:32 ldapm slapd[24629]: conn=23 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" method=118 May 11 17:22:32 ldapm slapd[24629]: conn=23 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" mech=SIMPLE ssf=0 May 11 17:22:32 ldapm slapd[24629]: conn=23 op=0 RESULT tag=97 err=0 text= May 11 17:22:32 ldapm slapd[24629]: conn=23 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=10022))" May 11 17:22:32 ldapm slapd[24629]: conn=23 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 17:22:32 ldapm slapd[24629]: conn=23 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=23 fd=20 closed (connection lost) What should I do to fix the problem and bind the server anonymously but get the authetication working? Thanks. Luke ----- Original Message ---- From: Dieter Kluenter <dieter(a)dkluenter.de> To: openldap-technical(a)openldap.org Sent: Saturday, May 10, 2008 1:32:58 AM Subject: Re: Mystery - Authentication Would Fail If Not Binding With Server By Using cn=Manager Hi, Luke Lee <leeluke77(a)yahoo.com> writes: > I am running OpenLDAP 2.3.39 on RedHat. My login authentication on a client > system will fail if I don't configure the optional binddn and bindpw by using > cn=Manager. > > Can anyone please enlighten me what could cause the strange problem? Thanks! Could you be a bit more specific and could you provide the access rules of slapd.conf? -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6 ________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. ________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

Mystery - Authentication Would Fail If Not Binding With Server By Using cn=Manager
by Luke Lee 12 May '08

12 May '08

My access rules in the slapd.conf are the following: access to attrs=userPassword by self write by anonymous auth by dn.base="cn=sysadmin,dc=mydomain,dc=com" write by group.exact="cn=itmanager,ou=manager,dc=mydomain,dc=com" write by * none access to * by self write by dn.base="cn=sysadmin,dc=mydomain,dc=com" write by group.exact="cn=itmanager,ou=manager,dc=mydomain,dc=com" write by * read If I don't have the following entries in a client's /etc/ldap.conf, when I login the client by using ssh I will get the "Access denied" message: binddn cn=Manager,dc=mydomain,dc=com bindpw secret The ldap log is the following: May 11 16:08:18 ldapm slapd[24629]: conn=0 fd=13 ACCEPT from IP=192.168.2.161:33801 (IP=0.0.0.0:389) May 11 16:08:18 ldapm slapd[24629]: conn=0 op=0 BIND dn="" method=128 May 11 16:08:18 ldapm slapd[24629]: conn=0 op=0 RESULT tag=97 err=0 text= May 11 16:08:18 ldapm slapd[24629]: conn=0 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=luke_l))" May 11 16:08:18 ldapm slapd[24629]: conn=0 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 16:08:18 ldapm slapd[24629]: conn=0 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= May 11 16:08:23 ldapm slapd[24629]: conn=0 op=2 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=luke_l))" May 11 16:08:23 ldapm slapd[24629]: conn=0 op=2 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 16:08:23 ldapm slapd[24629]: conn=0 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text= May 11 16:08:23 ldapm slapd[24629]: conn=1 fd=16 ACCEPT from IP=192.168.2.161:33802 (IP=0.0.0.0:389) May 11 16:08:23 ldapm slapd[24629]: conn=1 op=0 BIND dn="" method=128 May 11 16:08:23 ldapm slapd[24629]: conn=1 op=0 RESULT tag=97 err=0 text= May 11 16:08:23 ldapm slapd[24629]: conn=1 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(uid=luke_l)" May 11 16:08:23 ldapm slapd[24629]: conn=1 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= If I have the binddn and bindpw using the distinguished name, Manager, the login will succeed. The ldap log is the following: May 11 17:22:32 ldapm slapd[24629]: conn=20 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=20 op=4 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(uid=luke_l)" May 11 17:22:32 ldapm slapd[24629]: conn=20 op=4 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=20 op=5 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup)(|(memberUid=luke_l)(uniqueMember=uid=luke_l,ou=people,dc=mydomain,dc=com)))" May 11 17:22:32 ldapm slapd[24629]: conn=20 op=5 SRCH attr=cn userPassword memberUid uniqueMember gidNumber May 11 17:22:32 ldapm slapd[24629]: <= bdb_equality_candidates: (uniqueMember) not indexed May 11 17:22:32 ldapm slapd[24629]: conn=20 op=5 SEARCH RESULT tag=101 err=0 nentries=0 text= May 11 17:22:32 ldapm slapd[24629]: conn=20 op=6 UNBIND May 11 17:22:32 ldapm slapd[24629]: conn=20 fd=18 closed May 11 17:22:32 ldapm slapd[24629]: conn=21 fd=16 ACCEPT from IP=192.168.2.161:33816 (IP=0.0.0.0:389) May 11 17:22:32 ldapm slapd[24629]: conn=21 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" method=118 May 11 17:22:32 ldapm slapd[24629]: conn=21 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" mech=SIMPLE ssf=0 May 11 17:22:32 ldapm slapd[24629]: conn=21 op=0 RESULT tag=97 err=0 text= May 11 17:22:32 ldapm slapd[24629]: conn=21 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=10022))" May 11 17:22:32 ldapm slapd[24629]: conn=21 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 17:22:32 ldapm slapd[24629]: conn=21 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=18 op=6 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=luke_l))" May 11 17:22:32 ldapm slapd[24629]: conn=18 op=6 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 17:22:32 ldapm slapd[24629]: conn=18 op=6 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=22 fd=18 ACCEPT from IP=192.168.2.161:33817 (IP=0.0.0.0:389) May 11 17:22:32 ldapm slapd[24629]: conn=22 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" method=118 May 11 17:22:32 ldapm slapd[24629]: conn=22 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" mech=SIMPLE ssf=0 May 11 17:22:32 ldapm slapd[24629]: conn=22 op=0 RESULT tag=97 err=0 text= May 11 17:22:32 ldapm slapd[24629]: conn=22 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=10022))" May 11 17:22:32 ldapm slapd[24629]: conn=22 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 17:22:32 ldapm slapd[24629]: conn=22 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=23 fd=20 ACCEPT from IP=192.168.2.161:33818 (IP=0.0.0.0:389) May 11 17:22:32 ldapm slapd[24629]: conn=23 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" method=118 May 11 17:22:32 ldapm slapd[24629]: conn=23 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" mech=SIMPLE ssf=0 May 11 17:22:32 ldapm slapd[24629]: conn=23 op=0 RESULT tag=97 err=0 text= May 11 17:22:32 ldapm slapd[24629]: conn=23 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=10022))" May 11 17:22:32 ldapm slapd[24629]: conn=23 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 17:22:32 ldapm slapd[24629]: conn=23 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=23 fd=20 closed (connection lost) What should I do to fix the problem and bind the server anonymously but get the authetication working? Thanks. Luke ----- Original Message ---- From: Dieter Kluenter <dieter(a)dkluenter.de> To: openldap-technical(a)openldap.org Sent: Saturday, May 10, 2008 1:32:58 AM Subject: Re: Mystery - Authentication Would Fail If Not Binding With Server By Using cn=Manager Hi, Luke Lee <leeluke77(a)yahoo.com> writes: > I am running OpenLDAP 2.3.39 on RedHat. My login authentication on a client > system will fail if I don't configure the optional binddn and bindpw by using > cn=Manager. > > Can anyone please enlighten me what could cause the strange problem? Thanks! Could you be a bit more specific and could you provide the access rules of slapd.conf? -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6 ________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

Re: Mystery - Authentication Would Fail If Not Binding With Server By Using cn=Manager
by Luke Lee 12 May '08

12 May '08

My access rules in the slapd.conf are the following: access to attrs=userPassword by self write by anonymous auth by dn.base="cn=sysadmin,dc=mydomain,dc=com" write by group.exact="cn=itmanager,ou=manager,dc=mydomain,dc=com" write by * none access to * by self write by dn.base="cn=sysadmin,dc=mydomain,dc=com" write by group.exact="cn=itmanager,ou=manager,dc=mydomain,dc=com" write by * read If I don't have the following entries in a client's /etc/ldap.conf, when I login the client by using ssh I will get the "Access denied" message: binddn cn=Manager,dc=mydomain,dc=com bindpw secret The ldap log is the following: May 11 16:08:18 ldapm slapd[24629]: conn=0 fd=13 ACCEPT from IP=192.168.2.161:33801 (IP=0.0.0.0:389) May 11 16:08:18 ldapm slapd[24629]: conn=0 op=0 BIND dn="" method=128 May 11 16:08:18 ldapm slapd[24629]: conn=0 op=0 RESULT tag=97 err=0 text= May 11 16:08:18 ldapm slapd[24629]: conn=0 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=luke_l))" May 11 16:08:18 ldapm slapd[24629]: conn=0 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 16:08:18 ldapm slapd[24629]: conn=0 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= May 11 16:08:23 ldapm slapd[24629]: conn=0 op=2 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=luke_l))" May 11 16:08:23 ldapm slapd[24629]: conn=0 op=2 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 16:08:23 ldapm slapd[24629]: conn=0 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text= May 11 16:08:23 ldapm slapd[24629]: conn=1 fd=16 ACCEPT from IP=192.168.2.161:33802 (IP=0.0.0.0:389) May 11 16:08:23 ldapm slapd[24629]: conn=1 op=0 BIND dn="" method=128 May 11 16:08:23 ldapm slapd[24629]: conn=1 op=0 RESULT tag=97 err=0 text= May 11 16:08:23 ldapm slapd[24629]: conn=1 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(uid=luke_l)" May 11 16:08:23 ldapm slapd[24629]: conn=1 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= If I have the binddn and bindpw using the distinguished name, Manager, the login will succeed. The ldap log is the following:May 11 17:22:32 ldapm slapd[24629]: conn=20 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=20 op=4 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(uid=luke_l)" May 11 17:22:32 ldapm slapd[24629]: conn=20 op=4 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=20 op=5 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup)(|(memberUid=luke_l)(uniqueMember=uid=luke_l,ou=people,dc=mydomain,dc=com)))" May 11 17:22:32 ldapm slapd[24629]: conn=20 op=5 SRCH attr=cn userPassword memberUid uniqueMember gidNumber May 11 17:22:32 ldapm slapd[24629]: <= bdb_equality_candidates: (uniqueMember) not indexed May 11 17:22:32 ldapm slapd[24629]: conn=20 op=5 SEARCH RESULT tag=101 err=0 nentries=0 text= May 11 17:22:32 ldapm slapd[24629]: conn=20 op=6 UNBIND May 11 17:22:32 ldapm slapd[24629]: conn=20 fd=18 closed May 11 17:22:32 ldapm slapd[24629]: conn=21 fd=16 ACCEPT from IP=192.168.2.161:33816 (IP=0.0.0.0:389) May 11 17:22:32 ldapm slapd[24629]: conn=21 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" method=118 May 11 17:22:32 ldapm slapd[24629]: conn=21 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" mech=SIMPLE ssf=0 May 11 17:22:32 ldapm slapd[24629]: conn=21 op=0 RESULT tag=97 err=0 text= May 11 17:22:32 ldapm slapd[24629]: conn=21 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=10022))" May 11 17:22:32 ldapm slapd[24629]: conn=21 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 17:22:32 ldapm slapd[24629]: conn=21 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=18 op=6 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=luke_l))" May 11 17:22:32 ldapm slapd[24629]: conn=18 op=6 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 17:22:32 ldapm slapd[24629]: conn=18 op=6 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=22 fd=18 ACCEPT from IP=192.168.2.161:33817 (IP=0.0.0.0:389) May 11 17:22:32 ldapm slapd[24629]: conn=22 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" method=118 May 11 17:22:32 ldapm slapd[24629]: conn=22 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" mech=SIMPLE ssf=0 May 11 17:22:32 ldapm slapd[24629]: conn=22 op=0 RESULT tag=97 err=0 text= May 11 17:22:32 ldapm slapd[24629]: conn=22 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=10022))" May 11 17:22:32 ldapm slapd[24629]: conn=22 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 17:22:32 ldapm slapd[24629]: conn=22 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=23 fd=20 ACCEPT from IP=192.168.2.161:33818 (IP=0.0.0.0:389) May 11 17:22:32 ldapm slapd[24629]: conn=23 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" method=118 May 11 17:22:32 ldapm slapd[24629]: conn=23 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" mech=SIMPLE ssf=0 May 11 17:22:32 ldapm slapd[24629]: conn=23 op=0 RESULT tag=97 err=0 text= May 11 17:22:32 ldapm slapd[24629]: conn=23 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=10022))" May 11 17:22:32 ldapm slapd[24629]: conn=23 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 17:22:32 ldapm slapd[24629]: conn=23 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=23 fd=20 closed (connection lost) What should I do to fix the problem and bind the server anonymously but get the authetication working? Thanks. Luke ----- Original Message ---- From: Dieter Kluenter <dieter(a)dkluenter.de> To: openldap-technical(a)openldap.org Sent: Saturday, May 10, 2008 1:32:58 AM Subject: Re: Mystery - Authentication Would Fail If Not Binding With Server By Using cn=Manager Hi, Luke Lee <leeluke77(a)yahoo.com> writes: > I am running OpenLDAP 2.3.39 on RedHat. My login authentication on a client > system will fail if I don't configure the optional binddn and bindpw by using > cn=Manager. > > Can anyone please enlighten me what could cause the strange problem? Thanks! Could you be a bit more specific and could you provide the access rules of slapd.conf? -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6 ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

Any success story using syncRepl with postgresql backend?
by Tommy Ho 12 May '08

12 May '08

I was wondering if anyone had success with using multi-master replication (syncrepl with mirrormode enabled) using postgresql as the backend? I had this working using BDB but when I switched over to use postgres as the backend, the synchronization becomes very erratic and inconsistent, deleted data from one master never gets propagated and newly added data will sometimes get sync'd and sometimes it doesn't. Thanks for any input, \Tommy

2 2

DHCP breaks LDAP?
by John Oliver 12 May '08

12 May '08

On two RHEL4u5 lab machines, LDAP authentication stopped working. The only thing that was done was DHCP was enabled on a previously-unconfigured interface. That messed up ntpd.conf, so I know that weird stuff was going on. Anyway, all attempts to log in with an LDAP user result in ldap_simple_bind: Can't contact LDAP server However, the machines can ping the LDAP server, and nmap shows 389 and 636 as open. /etc/ldap.conf has not changed. /etc/nsswitch.conf has not changed. I ran "authconfig" and the server line was empty, so I filled it in. No dice. I am completely stumped. -- *********************************************************************** * John Oliver http://www.john-oliver.net/ * * * ***********************************************************************

2 1

Mystery - Authentication Would Fail If Not Binding With Server By Using cn=Manager
by Luke Lee 10 May '08

10 May '08

I am running OpenLDAP 2.3.39 on RedHat. My login authentication on a client system will fail if I don't configure the optional binddn and bindpw by using cn=Manager. Can anyone please enlighten me what could cause the strange problem? Thanks! Luke ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 1

migration question
by Gordon 10 May '08

10 May '08

Our users have Thunderbird configured to search for email addressed in ldap our old ldap has a base DN of dc=sbg,dc=com our new ldap has a base DN of ou=people,dc=sbg,dc=com Is there a way to provide a view or alias of the new system so clients do not have to be updated to the new base DN?

3 2

AD + Openldap integration
by Rich West 08 May '08

08 May '08

I am not entirely sure where to ask this particular question, and I apologize in advance if this is not the correct forum... We have an AD infrastructure and we'd like to get all of our unix boxes to authenticate against the AD servers. I'm able to query against our AD servers by hand using: ldapsearch -x -LLL -E pr=200/noprompt -h ouradhost -D "CN=Administrator,OU=IT Department,OU=Users,OU=My Business,DC=ourdomain,DC=dotcom" -W -b "dc=ourdomain, dc=dotcom" -s sub "(cn=*)" And that gives me the entire tree, but I haven't made much progress from there. Honestly, I am unsure what 'right' resulting architecture would be: have each unix (linux, CentOS) system, using nss_ldap, authenticate against AD directly, or build an openldap replica of the AD contents (just user accounts) and have the unix boxes authenticate against that. Because of the AD layout, I'm not sure nss_ldap is even configurable enough to map users from the mess of groups within AD to one layer of users. The AD layout is messy.. the users are broken up in to different groups ("IT Department", "Executives", etc., etc) within AD, and it isn't straightforward on how to do a query just to get all users (regardless of the group). (unfortunately, I have no ability at this time to re-work the AD architecture, nor do I take responsibility for its current layout) Thanks! -Rich

3 4

change berkeley version
by Benjamin Bellec 08 May '08

08 May '08

Hello, I am new on this list. I am currently configuring a server (virtual machine) to use OpenLDAP 2.2.13 (must use this version) with Berkeley DB 4.2 (must use this version too). BDB 4.2 is the problem. My server use BDB 4.3 and I don't now how to tell OpenLDAP to use BDB 4.2 instead of 4.3. Any idea ? Thanks, Benjamin.

3 4

Examples of back-meta with more than one AD domains
by Vittore Zen 07 May '08

07 May '08

Hi, I need some help to configure a solution to this problem: 1. Some Windows 2000/2003 AD domains 2. A unique openLDAP server I want that openLDAP server contains all users account for every domains (the next step is setup a RADIUS server that use openLDAP as authentication source). I'm looking for a working examples of back-meta with more than one AD domains. Any ideas? Thanks in advance. v.

2 1

Re: How do I add multiple users to a group ldif file ?
by Pooja S 07 May '08

07 May '08

Thanks a lot. posixGroup worked with memberUid attribute.. Thank you so much.. Thanks, Pooja ----- Original Message ---- From: Javier Barroso <javibarroso(a)gmail.com> To: Pooja S <ldapuser(a)yahoo.com> Cc: openldap-technical(a)openldap.org Sent: Wednesday, May 7, 2008 4:31:40 AM Subject: Re: How do I add multiple users to a group ldif file ? On Tue, May 6, 2008 at 11:09 PM, Pooja S <ldapuser(a)yahoo.com> wrote: Hi All, Please help me setting up my groups with multiple group members. ... gidNumber: root,adm,daemon I understand gidNumber is the primary group of the user. If you want the user on several groups, you should look for "PosixGroup" object (or groupOfUniqueNames?) ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

Re: How do I add multiple users to a group ldif file ?
by Pooja S 07 May '08

07 May '08

Hi , Thank you for your reply to my query. I am still doing something wrong and it still doesnt work for me. Can you please replace the wrong with the correct attribute and objectclass: This is what I am using : dn: uid=adm,ou=Groups,dc=grow,dc=lan uid: adm cn: adm objectClass: account objectClass: posixAccount objectClass: PosixGroup objectClass: top objectClass: shadowAccount objectClass: inetOrgPerson userPassword: {crypt}* shadowLastChange: 12864 shadowMax: 99999 shadowWarning: 7 uidNumber: 4 gidNumber: 4 memberuid: 0 homeDirectory: Thanks, Pooja ----- Original Message ---- From: Javier Barroso <javibarroso(a)gmail.com> To: Pooja S <ldapuser(a)yahoo.com> Cc: openldap-technical(a)openldap.org Sent: Wednesday, May 7, 2008 4:31:40 AM Subject: Re: How do I add multiple users to a group ldif file ? On Tue, May 6, 2008 at 11:09 PM, Pooja S <ldapuser(a)yahoo.com> wrote: Hi All, Please help me setting up my groups with multiple group members.. ... gidNumber: root,adm,daemon I understand gidNumber is the primary group of the user. If you want the user on several groups, you should look for "PosixGroup" object (or groupOfUniqueNames?) ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

How do I add multiple users to a group ldif file ?
by Pooja S 07 May '08

07 May '08

Hi All, Please help me setting up my groups with multiple group members. Here is the example of a group "adm" which I want to add as group with group member "root, adm, deamon" whereas root and deamon groups already exist. Here is the ldif config for adm group: dn: uid=adm,ou=Groups,dc=abc,dc=xyz uid: adm cn: adm objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {crypt}* shadowLastChange: 12864 shadowMax: 99999 shadowWarning: 7 uidNumber: 4 gidNumber: root,adm,daemon homeDirectory: When I try to add I get this error . #ldapadd -x -D 'cn=Manager,dc=abc,dc=xyz' -W -f bin.ldif Enter LDAP Password: adding new entry "uid=adm,ou=People,dc=grow" ldap_add: Invalid syntax additional info: gidNumber: value #0 invalid per syntax I have tried various options, such as: gidNumber: 4, 0, 3 gidNumber: 4 gidNumber: 0 gidNumber: 3 Error : adding new entry "uid=adm,ou=People,dc=grow" ldap_add: Constraint violation additional info: gidNumber: multiple values provided Or tried replacing gidNumber with uidNumber. It still doesnt work. Any help is highly appreciated. Thanks, Pooja ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 1

Read encrypted userPassword from Mysql
by jbeezer02 06 May '08

06 May '08

I have been struggling with this for days now, trying different setups to no avail. I have openldap 2.3.40 installed and functioning (at least enough to read) with a mysql backend that is configured through unixODBC. I want to map the 'userPassword' attribute to a Mysql view that will contain the information from our other Mysql databases, such as username, name_first, password, salt, etc. Now the problem becomes how to read the encrypted format of our passwords. Our passwords are stored in Mysql the following way- /UPDATE user SET salt="'.$salt.'", password=SHA1(AES_ENCRYPT("'.$string.'","'.$salt.'")) WHERE id='.$this->id /where salt is generated by- /$salt = substr(md5(uniqid(rand(), true)), 0, 64); /Now I know that openldap doesn't support AES_ENCRYPTION, however it does support SHA. Now, the problem with this setup seems to be that I can't find a way to un-SHA the passwords, and then have it do an AES_DECRYPT. So I have been trying to switch the SHA and AES around so that, when a password is stored it is actually SHA encrypted first, and then AES_ENCRYPTED over top of that (granted, not quite as secure). I think that would enable me to use the AES_DECRYPT function in my 'ldap_attr_mappings' table to read the decrypted AES passwords, and then just check them with SHA. I have been trying to figure out all the base64 encoding that I have to mess with to read the encrypted formats, with not much luck. Has anyone done anything similar to this before? Is there a better way to read our encrypted Mysql passwords? This ldap is going to be used for VPN authentication, so I'm not concerned with writing data to it, just need to be able to read a users password. Thanks.

1 0

bdb_add: parent does not exist
by Rakesh Yadav 06 May '08

06 May '08

Hi */usr/local/libexec/slapd -n super -4 -V -d 1 & *Output: [1] 32204 [root@super ~]# @(#) $OpenLDAP: slapd 2.3.39 (May 6 2008 19:56:13) $ root@super:/root/ums/openldap-2.3.39/servers/slapd @(#) $OpenLDAP: slapd 2.3.39 (May 6 2008 19:56:13) $ root@super:/root/ums/openldap-2.3.39/servers/slapd daemon_init: listen on ldap:/// daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap:///) daemon: listener initialized ldap:/// daemon_init: 1 listeners opened super init: initiated server. bdb_back_initialize: initialize BDB backend bdb_back_initialize: Sleepycat Software: Berkeley DB 4.3.29: (September 12, 2006) hdb_back_initialize: initialize HDB backend hdb_back_initialize: Sleepycat Software: Berkeley DB 4.3.29: (September 12, 2006) bdb_db_init: Initializing BDB database >>> dnPrettyNormal: <dc=my-domain,dc=com> <<< dnPrettyNormal: <dc=my-domain,dc=com>, <dc=my-domain,dc=com> >>> dnPrettyNormal: <cn=Manager,dc=my-domain,dc=com> <<< dnPrettyNormal: <cn=Manager,dc=my-domain,dc=com>, <cn=manager,dc=my-domain,dc=com> >>> dnNormalize: <cn=Subschema> <<< dnNormalize: <cn=subschema> matching_rule_use_init 1.2.840.113556.1.4.804 (integerBitOrMatch): matchingRuleUse: ( 1.2.840.113556.1.4.804 NAME 'integerBitOrMatch' APPLIES ( supportedLDAPVersion $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcDbCacheFree $ olcDbCacheSize $ olcDbIDLcacheSize $ olcDbMode $ olcDbSearchStack $ olcDbShmKey $ olcSpSessionlog $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber ) ) 1.2.840.113556.1.4.803 (integerBitAndMatch): matchingRuleUse: ( 1.2.840.113556.1.4.803 NAME 'integerBitAndMatch' APPLIES ( supportedLDAPVersion $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcDbCacheFree $ olcDbCacheSize $ olcDbIDLcacheSize $ olcDbMode $ olcDbSearchStack $ olcDbShmKey $ olcSpSessionlog $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber ) ) 1.3.6.1.4.1.1466.109.114.2 (caseIgnoreIA5Match): matchingRuleUse: ( 1.3.6.1.4.1.1466.109.114.2 NAME 'caseIgnoreIA5Match' APPLIES ( altServer $ mail $ dc $ associatedDomain $ email $ aRecord $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMailbox $ gecos $ homeDirectory $ loginShell $ memberUid $ memberNisNetgroup $ ipHostNumber $ ipNetworkNumber $ ipNetmaskNumber $ macAddress $ bootFile $ nisMapEntry ) ) 1.3.6.1.4.1.1466.109.114.1 (caseExactIA5Match): matchingRuleUse: ( 1.3.6.1.4.1.1466.109.114.1 NAME 'caseExactIA5Match' APPLIES ( altServer $ mail $ dc $ associatedDomain $ email $ aRecord $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMailbox $ gecos $ homeDirectory $ loginShell $ memberUid $ memberNisNetgroup $ ipHostNumber $ ipNetworkNumber $ ipNetmaskNumber $ macAddress $ bootFile $ nisMapEntry ) ) 2.5.13.35 (certificateMatch): matchingRuleUse: ( 2.5.13.35 NAME 'certificateMatch' APPLIES ( userCertificate $ cACertificate ) ) 2.5.13.34 (certificateExactMatch): matchingRuleUse: ( 2.5.13.34 NAME 'certificateExactMatch' APPLIES ( userCertificate $ cACertificate ) ) 2.5.13.30 (objectIdentifierFirstComponentMatch): matchingRuleUse: ( 2.5.13.30 NAME 'objectIdentifierFirstComponentMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ ldapSyntaxes $ supportedApplicationContext ) ) 2.5.13.29 (integerFirstComponentMatch): matchingRuleUse: ( 2.5.13.29NAME 'integerFirstComponentMatch' APPLIES ( supportedLDAPVersion $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcDbCacheFree $ olcDbCacheSize $ olcDbIDLcacheSize $ olcDbMode $ olcDbSearchStack $ olcDbShmKey $ olcSpSessionlog $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber ) ) 2.5.13.27 (generalizedTimeMatch): matchingRuleUse: ( 2.5.13.27 NAME 'generalizedTimeMatch' APPLIES ( createTimestamp $ modifyTimestamp ) ) 2.5.13.24 (protocolInformationMatch): matchingRuleUse: ( 2.5.13.24 NAME 'protocolInformationMatch' APPLIES protocolInformation ) 2.5.13.23 (uniqueMemberMatch): matchingRuleUse: ( 2.5.13.23 NAME 'uniqueMemberMatch' APPLIES uniqueMember ) 2.5.13.22 (presentationAddressMatch): matchingRuleUse: ( 2.5.13.22 NAME 'presentationAddressMatch' APPLIES presentationAddress ) 2.5.13.20 (telephoneNumberMatch): matchingRuleUse: ( 2.5.13.20 NAME 'telephoneNumberMatch' APPLIES ( telephoneNumber $ homePhone $ mobile $ pager ) ) 2.5.13.17 (octetStringMatch): matchingRuleUse: ( 2.5.13.17 NAME 'octetStringMatch' APPLIES userPassword ) 2.5.13.16 (bitStringMatch): matchingRuleUse: ( 2.5.13.16 NAME 'bitStringMatch' APPLIES x500UniqueIdentifier ) 2.5.13.14 (integerMatch): matchingRuleUse: ( 2.5.13.14 NAME 'integerMatch' APPLIES ( supportedLDAPVersion $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcDbCacheFree $ olcDbCacheSize $ olcDbIDLcacheSize $ olcDbMode $ olcDbSearchStack $ olcDbShmKey $ olcSpSessionlog $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber ) ) 2.5.13.13 (booleanMatch): matchingRuleUse: ( 2.5.13.13 NAME 'booleanMatch' APPLIES ( hasSubordinates $ olcGentleHUP $ olcLastMod $ olcReadOnly $ olcReverseLookup $ olcDbNoSync $ olcDbDirtyRead $ olcDbLinearIndex $ olcSpNoPresent $ olcSpReloadHint ) ) 2.5.13.11 (caseIgnoreListMatch): matchingRuleUse: ( 2.5.13.11 NAME 'caseIgnoreListMatch' APPLIES ( postalAddress $ registeredAddress $ homePostalAddress ) ) 2.5.13.8 (numericStringMatch): matchingRuleUse: ( 2.5.13.8 NAME 'numericStringMatch' APPLIES ( x121Address $ internationaliSDNNumber ) ) 2.5.13.7 (caseExactSubstringsMatch): matchingRuleUse: ( 2.5.13.7 NAME 'caseExactSubstringsMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.6 (caseExactOrderingMatch): matchingRuleUse: ( 2.5.13.6 NAME 'caseExactOrderingMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.5 (caseExactMatch): matchingRuleUse: ( 2.5.13.5 NAME 'caseExactMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcInclude $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcSizeLimit $ olcSrvtab $ olcSubordinate $ olcSyncrepl $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbConfig $ olcDbIndex $ olcDbLockDetect $ olcSpCheckpoint $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName $ destinationIndicator $ givenName $ initials $ generationQualifier $ dnQualifier $ houseIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info $ drink $ roomNumber $ userClass $ host $ documentIdentifier $ documentTitle $ documentVersion $ documentLocation $ personalTitle $ co $ uniqueIdentifier $ organizationalStatus $ buildingName $ documentPublisher $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ preferredLanguage $ ipServiceProtocol $ nisMapName $ uName $ upwd ) ) 2.5.13.4 (caseIgnoreSubstringsMatch): matchingRuleUse: ( 2.5.13.4 NAME 'caseIgnoreSubstringsMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.3 (caseIgnoreOrderingMatch): matchingRuleUse: ( 2.5.13.3 NAME 'caseIgnoreOrderingMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.2 (caseIgnoreMatch): matchingRuleUse: ( 2.5.13.2 NAME 'caseIgnoreMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcInclude $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcSizeLimit $ olcSrvtab $ olcSubordinate $ olcSyncrepl $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbConfig $ olcDbIndex $ olcDbLockDetect $ olcSpCheckpoint $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName $ destinationIndicator $ givenName $ initials $ generationQualifier $ dnQualifier $ houseIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info $ drink $ roomNumber $ userClass $ host $ documentIdentifier $ documentTitle $ documentVersion $ documentLocation $ personalTitle $ co $ uniqueIdentifier $ organizationalStatus $ buildingName $ documentPublisher $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ preferredLanguage $ ipServiceProtocol $ nisMapName $ uName $ upwd ) ) 1.2.36.79672281.1.13.3 (rdnMatch): 2.5.13.1(distinguishedNameMatch): matchingRuleUse: ( 2.5.13.1 NAME 'distinguishedNameMatch' APPLIES ( creatorsName $ modifiersName $ subschemaSubentry $ namingContexts $ aliasedObjectName $ distinguishedName $ seeAlso $ olcDefaultSearchBase $ olcRootDN $ olcSchemaDN $ olcSuffix $ olcUpdateDN $ member $ owner $ roleOccupant $ manager $ documentAuthor $ secretary $ associatedName $ dITRedirect ) ) 2.5.13.0 (objectIdentifierMatch): matchingRuleUse: ( 2.5.13.0 NAME 'objectIdentifierMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ supportedApplicationContext ) ) super startup: initiated. backend_startup_one: starting "cn=config" config_back_db_open config_build_entry: "cn=config" config_build_entry: "cn=include{0}" config_build_entry: "cn=include{1}" config_build_entry: "cn=include{2}" config_build_entry: "cn=include{3}" config_build_entry: "cn=include{4}" config_build_entry: "cn=schema" config_build_entry: "cn={0}core" config_build_entry: "cn={1}cosine" config_build_entry: "cn={2}inetorgperson" config_build_entry: "cn={3}nis" config_build_entry: "cn={4}ums" config_build_entry: "olcDatabase={-1}frontend" config_build_entry: "olcDatabase={0}config" config_build_entry: "olcDatabase={1}bdb" backend_startup_one: starting "dc=my-domain,dc=com" bdb_db_open: dbenv_open(/usr/local/var/openldap-data) slapd starting ======================================================== *ums.schema : *attributetype ( 1.3.6.1.4.1.6863.2.3.200 NAME ( 'uName' ) DESC 'group owner id of gfs user' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) attributetype ( 1.3.6.1.4.1.6863.2.3.201 NAME ( 'upwd' ) DESC 'group owner id of gfs user' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) objectclass ( 1.3.6.1.4.1.6863.2.4.150 Name 'umsUser' DESC 'gfs group information' SUP top STRUCTURAL MUST ( uName $ upwd ) ) * *================================================* *slapd.conf :* *# # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/ums.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=my-domain,dc=com" rootdn "cn=Manager,dc=my-domain,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq ================================================================ *ums.ldif : *dn: uName=rkyadav,dc=my-domain,dc=com objectClass: top objectClass: umsUser uName: rkyadav upwd: rkyadav123 * *==============================================================* * *ldapadd -x -h "super" -D "cn=Manager,dc=my-domain,dc=com" -w "secret" -f ums.ldif *Output : >>> slap_listener(ldap:///) connection_get(11): got connid=0 connection_read(11): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 48 contents: ber_get_next do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: >>> dnPrettyNormal: <cn=Manager,dc=my-domain,dc=com> <<< dnPrettyNormal: <cn=Manager,dc=my-domain,dc=com>, <cn=manager,dc=my-domain,dc=com> do_bind: version=3 dn="cn=Manager,dc=my-domain,dc=com" method=128 do_bind: v3 bind: "cn=Manager,dc=my-domain,dc=com" to "cn=Manager,dc=my-domain,dc=com" send_ldap_result: conn=0 op=0 p=3 send_ldap_response: msgid=1 tag=97 err=0 ber_flush: 14 bytes to sd 11 adding new entry "cn=Barbara J Jensen,dc=my-domain,dc=com" connection_get(11): got connid=0 connection_read(11): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 128 contents: ber_get_next do_add ber_scanf fmt ({m) ber: >>> dnPrettyNormal: <cn=Barbara J Jensen,dc=my-domain,dc=com> <<< dnPrettyNormal: <cn=Barbara J Jensen,dc=my-domain,dc=com>, <cn=barbara j jensen,dc=my-domain,dc=com> ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt (}) ber: bdb_dn2entry("cn=barbara j jensen,dc=my-domain,dc=com") => bdb_dn2id("dc=my-domain,dc=com") <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) oc_check_required entry (cn=Barbara J Jensen,dc=my-domain,dc=com), objectClass "person" oc_check_allowed type "cn" oc_check_allowed type "objectClass" oc_check_allowed type "sn" oc_check_allowed type "structuralObjectClass" oc_check_allowed type "entryUUID" oc_check_allowed type "creatorsName" oc_check_allowed type "createTimestamp" oc_check_allowed type "entryCSN" oc_check_allowed type "modifiersName" oc_check_allowed type "modifyTimestamp" bdb_dn2entry("cn=barbara j jensen,dc=my-domain,dc=com") => bdb_dn2id("dc=my-domain,dc=com") <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) *is_entry_objectclass("", "2.16.840.1.113730.3.2.6") no objectClass attribute* *bdb_add: parent does not exist* send_ldap_result: conn=0 op=1 p=3 send_ldap_response: msgid=2 tag=105 err=32 ber_flush: 14 bytes to sd 11 *ldapadd: No such object (32)* connection_get(11): got connid=0 connection_read(11): checking for input on id=0 ber_get_next ber_get_next: tag 0x30 len 5 contents: ber_get_next do_unbind connection_closing: readying conn=0 sd=11 for close connection_resched: attempting closing conn=0 sd=11 connection_close: conn=0 sd=11 =============================================================== Please tell me why i m geeting this error? If there is a problem then where it is ? Thanks -- Rakesh Yadav Pune.

2 1

backend shell error
by Chris Henderson 06 May '08

06 May '08

I have compiled OpenLDAP v2.4.8 (./configure --enable-backends=yes --enable-overlays=yes) and trying to put a shell script on my slapd.conf to parse LDAP queries. But when I run slaptest I get: "unknown directive <search> inside backend database definition" error. Here is my slapd.conf - include /usr/local/etc/openldap/schema/core.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args Allow bind_v2 access to dn.base="" by * read access to * by * read backend shell database ldap suffix "dc=activedirectory,dc=domain,dc=tld" uri "ldap://activedirectory.domain.tld" search shell_script.sh Any help on this would be much appreciated. Thanks.

2 1

back_ldap.la on Fedora
by Chris Henderson 05 May '08

05 May '08

I am running OpenLDAP 2.3.37 on Fedora Linux; I need the "back_ldap.la" module for a backend shell script but it doesn't come with my version of OpenLDAP and I am unable to find this module anywhere else on the Internet. Would anyone know how I am going to install this module on my computer? Thanks for any help.

2 2

Problem to start openldapldap
by youness hsina 05 May '08

05 May '08

Hi all, i'm new to LDAP, i'm trying to make an Openldap server in FreeBSD, my problem is : i can't get start this server . even the file syslog i can't find it here is my debug.log file : *May 2 09:51:30 stavril slapd[967]: @(#) $OpenLDAP: slapd 2.3.41 (Apr 25 2008 14:56:51) $ root(a)stavril.gtr.iut-velizy.uvsq.fr: /usr/ports/net/openldap23-server/work/openldap-2.3.41/servers/slapd May 2 09:51:30 stavril slapd[967]: connections_destroy: nothing to destroy. May 2 09:51:30 stavril slapd[967]: /usr/local/etc/openldap/slapd.conf: line 83: <database> failed init (bdb)! May 2 09:51:30 stavril slapd[967]: slapd stopped. May 2 10:04:13 stavril slapd[55570]: connections_destroy: nothing to destroy. May 2 11:15:17 stavril slapd[62838]: @(#) $OpenLDAP: slapd 2.3.41 (Apr 25 2008 14:56:51) $ root(a)stavril.gtr.iut-velizy.uvsq.fr: /usr/ports/net/openldap23-server/work/openldap-2.3.41/servers/slapd May 2 11:15:17 stavril slapd[62838]: daemon: getaddrinfo() failed: hostname nor servname provided, or not known May 2 11:15:17 stavril slapd[62838]: slapd stopped. May 2 11:15:17 stavril slapd[62838]: connections_destroy: nothing to destroy.* is any one have ths same problem, please i need your help best regards uness

2 1

Disk Quota with LDAP
by Shafiqul Abedin 05 May '08

05 May '08

Hello All: I am new to this forum. If I am making any mistakes, please let me know. After searching google a million times, I am finally asking you guys. How do I set disk quota with LDAP? Is it possible to do it at all? Any docuentation? Any help? I am new to LDAP. Please help. Thanks ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 1

Tony Earnshaw, 29/02/40 - 29/04/08
by Ace Suares 04 May '08

04 May '08

Dear List, Tony Earnshaw, active member of this list, has passed away last Tuesday. About a month ago he was diagnosed with stage 5 lung cancer and within a very short time Tony left us. Tony's body will be cremated Monday 5th of May in Amsterdam. For those who want to express their feelings, please visit http://www.xs4all.nl/~snore/tony If among you there are people who want to have more information, send me an email at ace(a)suares.an and I will forward it to the kind people that take care of his affairs. With Sadness, Ace Suares

1 0

query Active Directory
by Chris Henderson 04 May '08

04 May '08

I am querying AD to get the first proxyaddresses:smtp field with only the username but it is giving me lots of other information that I don't really need. I was wondering if it is be possible to filter the query in slapd.conf to give me what I need. Here's my slapd.conf Allow bind_v2 access to dn.base="" by * read access to * by * read database ldap suffix "dc=ad3,dc=merog,dc=org" uri "ldap://ad3.merog.org" query_filter=(PROXYADDRESSES :smtp:%s@*) cachesize 10000 sizelimit unlimited I am querying for PROXYADDRESSES which comes like this: PROXYADDRESSES: smtp:username@merog.org - I only want the "username" bit. Here's my query: ldapsearch -x -h ad3.merog.org -b "dc=ad3,dc=merog,dc=org" cn="user name" I don't want to use any sed, awk script to achieve the result. Just would like to use openldap itself if that's at all possible. Thanks for any help.

4 6

Authentication Problem Regarding aliasedObjectName
by Christian Felsing 02 May '08

02 May '08

Hello, my installation has two OUs, one contains real inetOrgPerson objects, other one contains aliases to the first OU. First OU contains DNs which are not acceptable to a specific application (pls. don't ask me why) so 2nd OU was introduced with DNs which are acceptable to that application. Unfortunally, authentication to an alias seems to be not possible, because that application is not able to do dereferencing. OU1: # 007(a)x86.be, freemail, my.net dn: uid=007(a)example.com,ou=mail,dc=my,dc=net objectClass: top objectClass: inetOrgPerson uid: 007(a)x86.be cn: testuser Application does not like DN "uid=007(a)example.com,ou=mail,dc=my,dc=net" but other applications depend on it. So following was introduced: OU2: # testuser, members, my.net dn: uid=testuser,ou=members,dc=my,dc=net objectClass: top objectClass: alias objectClass: extensibleObject uid: testuser aliasedObjectName: uid=007(a)example.com,ou=mail,dc=my,dc=net That application would accept DN "uid=testuser,ou=members,dc=my,dc=net", but is not able to dereference that to "uid=007(a)example.com,ou=mail,dc=my,dc=net" :-( Is there a way to let a proxy do dereferencing an aliasedObjectName to "real" object, so that application may be able to authenticate to that proxy ? best regards Christian

2 1

how to stop openldap
by Paul Lee 02 May '08

02 May '08

I know to start openldap, the following command is used. > slapd -f slapd.conf but to shutdown openldap, what is the command used ? Currently, I am using "pkill slapd" but I think it's not the proper way. Thanks Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

2 1

Starting Openldap and adding a new entry into the dabase
by youness hsina 02 May '08

02 May '08

Hi All, i'm a french student, i'm trying to make an Opendldap server on FreeBSD. my openldap version is : openldap-2.3.41 i configured the "slapd.conf" and ldap.conf" in order to start the server. i have two problems the first one is : i try to start the server but it doesn't work ... i don't understand whay it doesn"t work!! stavril# /usr/local/etc/rc.d/slapd start Starting slapd. stavril# /usr/local/etc/rc.d/slapd status slapd is not running. the 2 nd one is : i want to add a new entry into my database but i can't !! stavril# ldapadd -h localhost -x -f test.ldif ldap_bind: Can't contact LDAP server (-1) here there are the files of configuration : slapd.conf, ldap.conf, test.ldif, rc.conf *stavril# cat slapd.conf* # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema #include /usr/local/etc/openldap/schema/nis.schema schemacheck on # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: modulepath /usr/local/libexec/openldap moduleload back_bdb # moduleload back_ldap # moduleload back_ldbm # moduleload back_passwd # moduleload back_shell # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! access to attrs=userPassword by dn="cn=Manager,dc=uvsq,dc=fr" write by dn="cn=proxyuser,dc=uvsq,dc=fr" read by self write by anonymous auth by * none access to attrs=uidNumber,gidNumber by dn="cn=Manager,dc=uvsq,dc=fr" write by dn="cn=proxyuser,dc=uvsq,dc=fr" read by * read access to * by dn="cn=Manager,dc=uvsq,dc=fr" write by self write by * read ##################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=uvsq,dc=fr" rootdn "cn=Manager,dc=uvsq,dc=fr" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/db/openldap-data mode 700 # indice to maintain index objectClass eq #last modification lastmod on *stavril# cat ldap.conf* # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example, dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 BASE dc=uvsq, dc=fr URI ldap://127.0.0.1/ ldap_version 3 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never stavril# cat test.ldif dn: dc=uvsq, dc= fr dc: uvsq objectClass: top objectClass: domain dn: cn=Manager, dc=uvsq, dc=fr objectClass: organizationalRole cn: Manager *rc.conf (the importante lines) * slapd_enable="YES" slapd_flags="-h ldap://%2fvar%2frun%2fopenldap%2fldapi/ ldap://0.0.0.0" slapd_sockets="/var/run/openldap/ldapi" stavril# cat test.ldif dn: dc=uvsq, dc= fr dc: uvsq objectClass: top objectClass: domain dn: cn=Manager, dc=uvsq, dc=fr objectClass: organizationalRole cn: Manager i tried to find a soltuion to my problem 3 days ago without success, i'm waiting for you ideas. thank you very much best regards Uness

1 0

Re: Delete events not propogating with syncrepl
by Srinidhi Sharma 02 May '08

02 May '08

Hi Gavin, Here are the details . Following logs were available at -d255 level. user.ldif file ======== dn: cn=user19,ou=people,dc=example,dc=com objectclass: inetOrgPerson cn: user19 sn: user19-lastname1 uid: user19-user1-lastname1 userpassword: welcome1 carlicense: HISCAR 123 homephone: 555-111-2222 mail: user19(a)example.com description: cool guy ou: Human Resources Master node log file snippet: ==================== >>> dnPrettyNormal: <cn=user19,ou=people,dc=example,dc=com> => ldap_bv2dn(cn=user19,ou=people,dc=example,dc=com,0) <= ldap_bv2dn(cn=user19,ou=people,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=user19,ou=people,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=user19,ou=people,dc=example,dc=com)=0 <<< dnPrettyNormal: <cn=user19,ou=people,dc=example,dc=com>, <cn=user19,ou=people,dc=example,dc=com> bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") => bdb_entry_get: ndn: "cn=user19,ou=people,dc=example,dc=com" => bdb_entry_get: oc: "(null)", at: "(null)" bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") => bdb_entry_get: found entry: "cn=user19,ou=people,dc=example,dc=com" bdb_entry_get: rc=0 ==> bdb_delete: cn=user19,ou=people,dc=example,dc=com bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") => access_allowed: delete access to "ou=people,dc=example,dc=com" "children" requested <= root access granted => access_allowed: delete access granted by manage(=mwrscxd) => access_allowed: delete access to "cn=user19,ou=people,dc=example,dc=com" "entry" requested <= root access granted => access_allowed: delete access granted by manage(=mwrscxd) => bdb_dn2id_delete 0x11: "cn=user19,ou=people,dc=example,dc=com" bdb_idl_delete_key: 11 @cn=user19,ou=people,dc=example,dc=com bdb_idl_delete_key: 11 %ou=people,dc=example,dc=com bdb_idl_delete_key: 11 @ou=people,dc=example,dc=com <= bdb_dn2id_delete 0x11: 0 => index_entry_del( 17, "cn=user19,ou=people,dc=example,dc=com" ) => key_change(DELETE,11) bdb_idl_delete_key: 11 [860433ad] <= key_change 0 => key_change(DELETE,11) bdb_idl_delete_key: 11 [0250ebcb] <= key_change 0 => key_change(DELETE,11) bdb_idl_delete_key: 11 [8c70ccf9] bdb_idl_delete_key: 11 [860433ad] <= key_change 0 => key_change(DELETE,11) bdb_idl_delete_key: 11 [0250ebcb] <= key_change 0 => key_change(DELETE,11) bdb_idl_delete_key: 11 [8c70ccf9] <= key_change 0 => key_change(DELETE,11) bdb_idl_delete_key: 11 [0096defd] <= key_change 0 => key_change(DELETE,11) bdb_idl_delete_key: 11 [e8d6b696] <= key_change 0 => key_change(DELETE,11) bdb_idl_delete_key: 11 <= key_change 0 <= index_entry_del( 17, "cn=user19,ou=people,dc=example,dc=com" ) success ====> bdb_cache_delete( 17 ) bdb_delete: deleted id=00000011 dn="cn=user19,ou=people,dc=example,dc=com" send_ldap_result: conn=1 op=15 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=16 tag=107 err=0 ber_flush2: 14 bytes to sd 12 0000: 30 0c 02 01 10 6b 07 0a 01 00 04 00 04 00 0....k........ ldap_write: want=14, written=14 0000: 30 0c 02 01 10 6b 07 0a 01 00 04 00 04 00 0....k........ daemon: activity on 1 descriptor daemon: activity on: 12r daemon: read activity on 12 daemon: select: listen=7 active_threads=0 tvp=NULL connection_get(12) connection_get(12): got connid=1 connection_read(12): checking for input on id=1 Slave log snippet: ( I didnt see any log msg for delete entry in the slave, so wasnt sure what to cut/paste, so just cut/pasting the user addition log msg) ============= ber_scanf fmt ({mW}) ber: ber_dump: buf=5c5780 ptr=5c5892 end=5c58ca len=56 0000: 30 36 04 08 65 6e 74 72 79 43 53 4e 31 2a 04 28 06..entryCSN1*.( 0010: 32 30 30 38 30 35 30 32 30 39 34 33 34 36 2e 38 20080502094346.8 0020: 38 39 39 34 36 5a 23 30 30 30 30 30 30 23 30 30 89946Z#000000#00 0030: 30 23 30 30 30 30 30 30 0#000000 => bdb_search bdb_dn2entry("dc=example,dc=com") => access_allowed: search access to "dc=example,dc=com" "entry" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) search_candidates: base="dc=example,dc=com" (0x00000001) scope=2 => bdb_dn2idl("dc=example,dc=com") => bdb_filter_candidates AND => bdb_list_candidates 0xa0 => bdb_filter_candidates EQUALITY => bdb_equality_candidates (entryUUID) => key_read bdb_idl_fetch_key: [e8d6b696] <= bdb_index_read: failed (-30989) <= bdb_equality_candidates: id=0, first=0, last=0 <= bdb_filter_candidates: id=0 first=0 last=0 <= bdb_list_candidates: id=0 first=1 last=0 <= bdb_filter_candidates: id=0 first=1 last=0 bdb_search_candidates: id=0 first=1 last=0 bdb_search: no candidates send_ldap_result: conn=-1 op=0 p=3 send_ldap_result: err=0 matched="" text="" ==> bdb_add: cn=user19,ou=people,dc=example,dc=com bdb_dn2entry("cn=user19,ou=people,dc=example,dc=com") => bdb_dn2id("cn=user19,ou=people,dc=example,dc=com") <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) => access_allowed: add access to "ou=people,dc=example,dc=com" "children" requested <= root access granted => access_allowed: add access granted by manage(=mwrscxd) => access_allowed: add access to "cn=user19,ou=people,dc=example,dc=com" "entry" requested <= root access granted => access_allowed: add access granted by manage(=mwrscxd) => bdb_dn2id_add 0x11: "cn=user19,ou=people,dc=example,dc=com" bdb_idl_insert_key: 11 %ou=people,dc=example,dc=com bdb_idl_insert_key: 11 @ou=people,dc=example,dc=com <= bdb_dn2id_add 0x11: 0 => index_entry_add( 17, "cn=user19,ou=people,dc=example,dc=com" ) => key_change(ADD,11) bdb_idl_insert_key: 11 [860433ad] <= key_change 0 => key_change(ADD,11) bdb_idl_insert_key: 11 [0250ebcb] <= key_change 0 => key_change(ADD,11) bdb_idl_insert_key: 11 [8c70ccf9] <= key_change 0 => key_change(ADD,11) bdb_idl_insert_key: 11 [0096defd] <= key_change 0 => key_change(ADD,11) bdb_idl_insert_key: 11 [e8d6b696] <= key_change 0 => key_change(ADD,11) bdb_idl_insert_key: 11 <= key_change 0 <= index_entry_add( 17, "cn=user19,ou=people,dc=example,dc=com" ) success => entry_encode(0x00000011): cn=user19,ou=people,dc=example,dc=com bdb_add: added id=00000011 dn="cn=user19,ou=people,dc=example,dc=com" send_ldap_result: conn=-1 op=0 p=3 send_ldap_result: err=0 matched="" text="" ldap_msgfree ldap_result ld 5b9630 msgid 2 wait4msg ld 5b9630 msgid 2 (infinite timeout) wait4msg continue ld 5b9630 msgid 2 all 0 ** ld 5b9630 Connections: - Srinidhi On Wed, Apr 30, 2008 at 7:53 PM, Gavin Henry <ghenry(a)openldap.org> wrote: > Srinidhi Sharma wrote: > > > Hi, > > I am using open ldap 2.4.8 with Berkeley DB 4.6.21 ( I haven't applied > > any patch to either open ldap or to Berkeley DB). > > > > When I configure a slave process, the addition and modification of users > > get propogated from master to slave. But the deletion of users from the > > master do not get propogated. the slapd logs in the master show that user > > is getting deleted. > > > > Logs needed and an example user please ;-) > > > > I saw a old note " > > http://www.openldap.org/lists/openldap-bugs/200409/msg00001.html" which > > listed similar issue. > > > > > Not relevant as that's for 2.2. > > -- > Kind Regards, > > Gavin Henry. > OpenLDAP Engineering Team. > > E ghenry(a)OpenLDAP.org > > Community developed LDAP software. > > http://www.openldap.org/project/ > > Suretec Systems is a limited company registered in Scotland. Registered > number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie, > Aberdeenshire, AB51 4FP. > -- Thanks, Srinidhi

1 0

Recommendation for Web Interface for OpenLDAP
by Wes Modes 02 May '08

02 May '08

Howdy, I'm looking for a web interface for OpenLDAP. I want something pretty simple since I won't need to reorganize the entire DIT through the web, only add, delete, and modify users and groups. I'm using smbldap-tools which has it's own set of scripts that I can tap into. I will need to extend the web interface to modify the samba schema extensions to LDAP or run the smbldap-scripts. With that in mind, I am interested in something written in PHP or Perl that can be easily modified or extended. I'd love it if you can recommend a simple web interface for LDAP. If you can recommend something, please tell me what features appeal to you or work well for you. And how does it meet my criteria: * Simple - minimal bells and whistles * add, delete, and modify users * add, delete, and modify groups * secure - using SSL/TLS * linux and apache friendly * written in perl, php, or python Thanks for your help.

4 5

Re: syncrel seems ignore some of the LDAP update request
by Paul Lee 02 May '08

02 May '08

I setup 2-way master as shown in the config file previously. I think the openldap will sync the data once I update one of the openldap servers. I use a java program to update the data every 100ms. Thanks Gavin Henry wrote: > How did you bring the data over to the second MirrorMode node? > Confidential Communication - This e-mail (including any attachments) is confidential and may be legally privileged. If this e-mail has been sent to you by mistake please inform us by reply e-mail and then delete the e-mail, destroy any printed copy and do not disclose or use the information in it.

1 0

Passwd can not able to updated Centerlize LDAP Server
by Vipul Ramani 02 May '08

02 May '08

Hi all , I have openldap running on solaris 10 x86 server with all system users are migrated on LDAP TREE.!. I configure client on other solaris 10 x86 server. I can login( SSH and dtlogin) to other solaris 10 server using LDAP user . but while i am try to change password i m getting this problem do i missing anything . I am suspecting about pam.conf configuration. I tried couple of combinations but not able to get rid of this. Same configuration is working Linux ( as standard changes in system-auth config file...) I am using Solaris 10 ( intel) NATIVE LDAP Client as LDAP client. ==Solaris console=== bash-3.00$ passwd passwd: Changing password for vipul3 Enter existing login password: New Password: Re-enter new Password: passwd: vipul3 does not exist. Permission denied bash-3.00$ ======================== Var/adm/message Apr 30 02:27:30 xxxx passwd[6954]: [ID 574280 user.error] passwdutil: no legal LDAP authentication method configured Apr 30 02:27:30 xxxx passwd[6954]: [ID 574280 user.error] passwdutil: no legal LDAP authentication method configured ============================= -- Regards Vipul Ramani

1 0

Password policy definitions
by Gustavo Mendes de Carvalho 30 Apr '08

30 Apr '08

Hi there, I noted that ppolicy is yet in development and because of that I would like to check how can I do some password history check. I mean, how can I apply same password policy defined in /etc/pam.d/system-auth, like history, size, new chars when changing password, and so on ? I running OpenLDAP 2.2.13, because is the RHAS4 current version. Is there any way to force LDAP Seerver to use /etc/pam.d/system-auth definitions ? Thanks --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com

5 19

php script for LDAP_BIND
by divya shree 30 Apr '08

30 Apr '08

hii we r trying to write a php script to bind to the ldap server.. the php script is <?php // basic sequence with LDAP is connect, bind, search, interpret search // result, close connection echo "LDAP query test"; echo "Connecting ..."; $ds=ldap_connect("localhost"); // must be a valid LDAP server! echo "connect result is " . $ds ; if ($ds) { echo "Binding ..."; $r=ldap_bind($ds); // this is an "anonymous" bind, typically // read-only access echo "Bind result is " . $r ; } ?> we also tried doin $ldapset=ldap_set_option($ldapconn,LDAP_OPT_PROTOCOL_VERSION,3); and $ldapbind = ldap_bind($ldapconn, $ldaprdn, $ldappass); where Ldaprdn= rootdn in the slapd.conf file and ldappass is the password we r getting the following error in all the above cases LDAP query test Connecting ... connect result is Resource id #4 Binding ...PHP Warning: ldap_bind(): Unable to bind to server: Protocol error in /var/www/html/forms/ex1.php on line 12 plz help ASAP Thanks and Regards Divya --------------------------------- Unlimited freedom, unlimited storage. Get it now

2 1

autofs and ldap
by Luciana Romeiro Rodrigues 29 Apr '08

29 Apr '08

Hi! I run SLES 10.0 with openldap-stable-20071118. Could anyone offer me some advice, or point me in the right direction? Thanks, Luciana Follows the settings: 1- /etc/nsswitch.conf: automount: ldap 2- ldif: dn: ou=automount,dc=cp,dc=br ou: automount objectClass: top objectClass: organizationalUnit dn: ou=auto.master,ou=automount,dc=cp,dc=br ou: auto.master objectClass: top objectClass: automountMap dn: cn=/home, ou=auto.master,ou=automount,dc=cp,dc=br objectClass: top objectClass: automount automountInformation: ldap: server-ldap.cp.br:ou=auto.home,ou=automount,dc= cp,dc=br cn: /home dn: ou=auto.home, ou=automount,dc=cp,dc=br ou: auto.home objectClass: top objectClass: automountMap Users: dn: uid=lu,ou=auto.home,ou=automount,dc=cp,dc=br uid: lu cn: teste objectClass: automount automountInformation: -rw,soft,retrans=10,intr nfsserver.cp.br:/extra/home/lu 3- /etc/ldap.conf host 127.0.0.1 base dc=cp,dc=br 4- tembiru:/home # service autofs status Checking for service autofs: unused Configured Mount Points: ------------------------ /usr/sbin/automount /home ldap: "server-ldap.cp.br:ou=auto.home,ou=automount,dc=cp,dc=br" Active Mount Points: 5- su - lu warning: cannot change directory to /home/lu: No such file or directory -- ======================================================== Luciana F.Romeiro Rodrigues Analista de Suporte Fone: 3186-8513 - Novo Email: luciana.romeiro(a)cptec.inpe.br ========================================================

1 0

Ldap_SASL_Bind (simple): error
by divya shree 29 Apr '08

29 Apr '08

Hii I am uisng Openldap-2.4.7 on fedora core 7... i hav configured my slapd.conf file n ldap.conf file... n started the server using the comand /usr/local/libexec/slapd n wen i try to perform any client operation for ex... ldapsearch -x -b ' ' -s base '(objectclass=*)' namingContexts i get the following error.. Ldap_sasl_bind (simple) :can't connect to the server (-1)... Plz help ASAP Thanks and Regards Divya --------------------------------- Meet people who discuss and share your passions. Join them now.

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical