- openldap-technical - openldap.org

Communication exception during 500+ concurrent requests
by shekhar.shrinivasan＠gmail.com 01 Oct '21

01 Oct '21

Hi, Was load testing against openldap (slapd-meta) where we were trying to submit 1000 concurrent bind requests. This was done using the JMeter load testing tool. In every run approximately only 420-430 bind requests are successful and remaining 500+ bind requests fail with "Communication Exception" error. We also tried with 500 bind requests and the result was somewhat same - 420 odd successful and 70-80 failed with communication exception. We have openldap 2.4.56 installed on a RHEL 8.1 host with 32GB memory and 8CPU. We have configured max open files for the slapd process to be 65K . Our requirement is to support 6000 concurrent requests at minimum. Is there any configuration that can be tweaked to support this amount of concurrent load ? I do see "olcConcurrency" & "olcThreads" set to 0 and 16 respectively. Should we be tweaking these to support the required load, if yes what should be the values for those ? Please assist. Thank you for your help !

4 6

Re: OpenLDAP 2.6.0 testing call
by Nick Folino 30 Sep '21

30 Sep '21

Yes. I saw the update and tested it this morning. It's working now as I had previously assumed it would. Nick On Thu, Sep 30, 2021 at 11:38 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Wednesday, September 29, 2021 7:36 PM -0400 Nick Folino > <nick(a)folino.us> wrote: > > > > > Yes. Logging now continues to work after changes to config. > > > > > > But - adding levels works on the fly, but removing them doesn't. > > For instance this works fine: > > olcLogLevel: stats > > > > > > If I change it to "stats ACL" then the ACL data starts getting added to > > the log. No restart required. > > If I change it back to "stats" I keep getting ACL data until the > > directory is restarted. > > This should now be fixed. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Re: OpenLDAP 2.6.0 testing call
by Nick Folino 30 Sep '21

30 Sep '21

Yes. Logging now continues to work after changes to config. But - adding levels works on the fly, but removing them doesn't. For instance this works fine: olcLogLevel: stats If I change it to "stats ACL" then the ACL data starts getting added to the log. No restart required. If I change it back to "stats" I keep getting ACL data until the directory is restarted. Nick On Wed, Sep 29, 2021 at 5:49 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Wednesday, September 29, 2021 9:17 AM -0400 Nick Folino > <nick(a)folino.us> wrote: > > > > > I don't know what the expected results should be, but changing > > olcLogLevel while running causes all logging to the specified file to > > stop. > > > > Logging starts with the new level upon restart. > > This should now be fixed. :) > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

3 6

Re: OpenLDAP 2.6.0 testing call
by Nick Folino 29 Sep '21

29 Sep '21

Verified. New log options look good on Fedora 34. No issues with tests either. Thanks! Nick On Tue, Sep 28, 2021 at 3:10 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Friday, September 17, 2021 10:13 AM -0700 Quanah Gibson-Mount > <quanah(a)symas.com> wrote: > > > > > > > --On Tuesday, September 7, 2021 7:07 PM -0400 Nick Folino > > <nick(a)folino.us> wrote: > > > >> > >> Thanks Quanah. olcLogFile and olcLogFileOnly seem to have no effect. > >> Using them I still get logs only to the journal on Fedora 34. > > > > Hi Nick, > > > > I was able to reproduce this and have reopened the issue report. > > This is now fixed for slapd, work pending to fix for lloadd. > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 2

Re: OpenLDAP 2.6.0 testing call
by Nick Folino 28 Sep '21

28 Sep '21

Thanks Quanah. olcLogFile and olcLogFileOnly seem to have no effect. Using them I still get logs only to the journal on Fedora 34. Nick On Tue, Sep 7, 2021 at 5:19 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Tuesday, September 7, 2021 4:15 PM -0400 Nick Folino <nick(a)folino.us> > > wrote: > > > > > No issues on Fedora 34. Any docs on how to work with the new logging > > options? > > See slapd.conf(5) or slapd-config(5). In slapd.conf(5), search for > "logfile", in slapd-config(5), search for olcLogFile > > > Regards, > Quanah > > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 2

RESULT etime vs. qtime
by Michael Ströder 28 Sep '21

28 Sep '21

HI! I'm adapting my mtail program for log-based slapd metrics for release 2.5. 2.5 introduces qtime= and etime= in RESULT lines. Great! I could easily grab histogram metrics for both but that doubles time-series data in Prometheus. So I wonder what's the difference? Is it worth to always look at both? Ciao, Michael.

3 3

delta-sync replication setup
by frederic.goudal＠bordeaux-inp.fr 28 Sep '21

28 Sep '21

Hello, I'm trying to setup delta-sync replication. One difficulty I encounter is that the documentation only refer to the old slapd.conf syntax and not the cn=config one. It is a bit tricky to guess the olc names, objectClass and so on. Is it posssible to update the documentation ? By the way while trying to add the accesslog overlay to my main suffix the slapd daemon stopped with the following syslog entry : slapd[219917]: ch_realloc of 18446744071562067968 bytes failed Slapd 2.5.7 -- Frédéric Goudal Administrateur Systèmes et Réseaux Bordeaux-INP

2 2

struggling with meta_backend, active directory and memberof
by Marco Baiguera 27 Sep '21

27 Sep '21

Hello everyone, I am struggling to make an openldap/meta configuration work: i have two active directory domain/servers: dc=mysite,cd=com and dc=other,dc=mysite,dc=com my goal is to integrate both domains with an application who can integrate with a SINGLE ldap source for user authentication. i'd like to build an openldap meta/proxy to build a virtual tree with mysite.com (empty) --- ou=virtual, dc= mysite,dc =com --- ou=other, dc= mysite,dc =com I'm working with these configuration: database meta suffix "dc=mysite,cd=com" .. uri "ldap://SRV-xxxxxx/ou=virtual, dc= mysite,dc =com" readonly yes lastmod off suffixmassage "ou=virtual, dc= mysite,dc =com" "dc= mysite,dc =com" uri "ldap://SRV-yyyy/ou=other, dc= mysite,dc =com" readonly yes lastmod off suffixmassage "ou=other, dc= mysite,dc =com" "dc=other,dc=mysite,dc=com" The ldap tree is accessible but the group membership is wrong: the value of memberof attributes for every user still has the original value, not the remapped value,for example: cn=user,ou=someou,dc=mysite,cd=com cn=somegroup,ou=groups,dc=mysite,cd=com are seen by the client as cn=user,ou=someou,ou=virtual,dc=mysite,cd=com cn=somegroup,ou=groups,ou=virtual,dc=mysite,cd=com but the membeof attribute of user.someou.mysite.com is cn=somegroup,ou=groups,dc=mysite,cd=com i expect it to be membeof=cn=somegroup,ou=groups,ou=virtual,dc=mysite,cd=com Can someone advice if this is the correct way to address this problem ? Can someone point me to the proper documentation ? Thank you Marco

1 1

Failing while Configuring the OpenLDAP
by Challa N Kumar Reddy 27 Sep '21

27 Sep '21

Hi There, I am new to OpenLDAP and followed the steps mentioned in this quick start guide as it is https://www.openldap.org/doc/admin25/quickstart.html but failing the configuration of OpenLDAP. I followed the below steps on CentOS 8 with 2.5.7 and successfully installed but while configuring facing issues, please correct me if I am doing this in the wrong way. 1. Created a Linux user dedicated to OpenLDAP with the name "nchalla" which has sudo permissions. 2. Login with Root user and created a folder /u01 3. change permissions on /u01 (for time being granted 777 ( 4. change ownership of /u01 to "nchalla" 5. downloaded the tarball and extracted the OpenLDAP 2.5.7 7. downloaded the required developer libraries 8. Logged in as nchalla and navigated to the OpenLDAP 2.5.7 extracted folder and start compiling and installing with the below commands ./configure --prefix=/u01/ldap make depend make make test (all tests were passed) make install 9. Started the configuration following the below steps a. created a folder /u01/ldap/etc/slapd.d b. updated the slapd.ldif with our domain name c. navigate to /u01/ldap and executed the command below, sbin/slapadd -n 0 -F /u01/ldap/etc/slapd.d -l /u01/ldap/etc/openldap/slapd.ldif But getting an error message issue the above command Also , the next step is to start the slapd service but It seems like I couldn't start the service as shown in the below screenshot Please help! Thanks in advance.

2 3

Re: 2.5.7 - help understanding syslog local4
by Dave Macias 23 Sep '21

23 Sep '21

Just to update: by adding to cn=config : olcLogLevel: Stats or loglevel 256 to slapd.conf and with -d 0 and no other change to rsyslog.conf nor to journal.conf I get all my connections, LDAP operations, results logged via syslog to /var/log/slapd/slapd.conf Thank you!!! On Thu, Sep 23, 2021 at 12:23 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Thursday, September 23, 2021 6:45 PM +0200 Michael Ströder > <michael(a)stroeder.com> wrote: > > > Personally I have on my systems: > > > > In file /etc/systemd/journald.conf: > > > > [Journal] > > Storage=none > > ForwardToSyslog=yes > > > > In /etc/rsyslog.conf: > > > > $AddUnixListenSocket /dev/log > > > > And I start slapd with -d 0 and loglevel set. > > As a side note, I've encountered deadlocks on RHEL7 on extremely busy > systems when journald is integrated with syslog like this. It also has a > strong negative effect on performance. Whether the deadlock is RHEL7 > specific or not is unknown. > > When OpenLDAP 2.6 releases, syslog (and journald) can be bypassed entirely > and a purely local log file can be used, resulting in a significant > performance increase. > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Uplift from 2.3.20 to 2.4.50
by Viggo Simonsen 23 Sep '21

23 Sep '21

Hi community, I am trying to uplift a very old adaptation of OpenLDAP from 2.3.20 to 2.4.50. I first tried a one-step approach, cherry-picking my delta, based on 2.3.20 into 2.4.50 - but that was a daunting task, given that there is 14 years between the two releases I am now trying again with a step-wise approach, merging one revision at a time from 2.3.20 .. 2.3.43 - and then through the 2.4 releases. So far up to 2.3.43, this has been simple - however now, merging the 2.4 releases, I am facing a huge number of conflicts on nearly all files. It is most certainly due to a lack of ancestry between the 2.4 and 2.3 branches I assume that 2.3 has been merged to master, and 2.4 branched of master at some point, possibly before the 2.3.43 release In short, there is a unclear, and possible collapsed merge path between the 2.3 and 2.4 branches that makes the leap between them difficult Can someone from the development team advise, how I can get about making this transition in a smooth manner? Thanks /Viggo

3 2

configure: error: Could not locate Cyrus SASL
by Challa N Kumar Reddy 23 Sep '21

23 Sep '21

Hi There, I have installed all the libraries including Cyrus SASL but while trying to compile I am getting the captioned error, Could you please advise. [nchalla@server openldap-2.5.7]$ ./configure --prefix=/u01/ldap --disable-static --enable-debug --with-tls=auto --with-cyrus-sasl --enable-dynamic --enable-crypt --enable-spasswd --enable-slapd --enable-modules --enable-rlookups --enable-backends=mod --disable-ndb --disable-sql --disable-wt --enable-overlays=mod Configuring OpenLDAP 2.5.7-Release ... checking build system type... x86_64-pc-linux-gnu checking host system type... x86_64-pc-linux-gnu checking target system type... x86_64-pc-linux-gnu checking configure arguments... done checking for cc... cc checking for ar... ar checking for strip... strip checking whether make sets $(MAKE)... yes checking how to print strings... printf checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether cc accepts -g... yes checking for cc option to accept ISO C89... none needed checking for a sed that does not truncate output... /usr/bin/sed checking for grep that handles long lines and -e... /usr/bin/grep checking for egrep... /usr/bin/grep -E checking for fgrep... /usr/bin/grep -F checking for ld used by cc... /usr/bin/ld checking if the linker (/usr/bin/ld) is GNU ld... yes checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm -B checking the name lister (/usr/bin/nm -B) interface... BSD nm checking whether ln -s works... yes checking the maximum length of command line arguments... 1572864 checking how to convert x86_64-pc-linux-gnu file names to x86_64-pc-linux-gnu format... func_convert_file_noop checking how to convert x86_64-pc-linux-gnu file names to toolchain format... func_convert_file_noop checking for /usr/bin/ld option to reload object files... -r checking for objdump... objdump checking how to recognize dependent libraries... pass_all checking for dlltool... dlltool checking how to associate runtime and link libraries... printf %s\n checking for archiver @FILE support... @ checking for ranlib... ranlib checking for gawk... gawk checking command to parse /usr/bin/nm -B output from cc object... ok checking for sysroot... no checking for a working dd... /usr/bin/dd checking how to truncate binary pipes... /usr/bin/dd bs=4096 count=1 checking for mt... no checking if : is a manifest tool... no checking how to run the C preprocessor... cc -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking for dlfcn.h... yes checking for objdir... .libs checking if cc supports -fno-rtti -fno-exceptions... no checking for cc option to produce PIC... -fPIC -DPIC checking if cc PIC flag -fPIC -DPIC works... yes checking if cc static flag -static works... no checking if cc supports -c -o file.o... yes checking if cc supports -c -o file.o... (cached) yes checking whether the cc linker (/usr/bin/ld -m elf_x86_64) supports shared libraries... yes checking whether -lc should be explicitly linked in... no checking dynamic linker characteristics... GNU/Linux ld.so checking how to hardcode library paths into programs... immediate checking for shl_load... no checking for shl_load in -ldld... no checking for dlopen... no checking for dlopen in -ldl... yes checking whether a program can dlopen itself... yes checking whether a statically linked program can dlopen itself... yes checking whether stripping libraries is possible... yes checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... no checking how to run the C preprocessor... cc -E checking whether we are using MS Visual C++... no checking for windres... no checking for be_app in -lbe... no checking whether we are using the GNU C compiler... (cached) yes checking whether cc accepts -g... (cached) yes checking for cc option to accept ISO C89... (cached) none needed checking for cc depend flag... -M checking for afopen in -ls... no checking ltdl.h usability... yes checking ltdl.h presence... yes checking for ltdl.h... yes checking for lt_dlinit in -lltdl... yes checking for EBCDIC... no checking for ANSI C header files... yes checking for dirent.h that defines DIR... yes checking for library containing opendir... none required checking for sys/wait.h that is POSIX.1 compatible... yes checking whether termios.h defines TIOCGWINSZ... no checking whether sys/ioctl.h defines TIOCGWINSZ... yes checking arpa/inet.h usability... yes checking arpa/inet.h presence... yes checking for arpa/inet.h... yes checking arpa/nameser.h usability... yes checking arpa/nameser.h presence... yes checking for arpa/nameser.h... yes checking assert.h usability... yes checking assert.h presence... yes checking for assert.h... yes checking bits/types.h usability... yes checking bits/types.h presence... yes checking for bits/types.h... yes checking conio.h usability... no checking conio.h presence... no checking for conio.h... no checking crypt.h usability... yes checking crypt.h presence... yes checking for crypt.h... yes checking direct.h usability... no checking direct.h presence... no checking for direct.h... no checking errno.h usability... yes checking errno.h presence... yes checking for errno.h... yes checking fcntl.h usability... yes checking fcntl.h presence... yes checking for fcntl.h... yes checking filio.h usability... no checking filio.h presence... no checking for filio.h... no checking getopt.h usability... yes checking getopt.h presence... yes checking for getopt.h... yes checking grp.h usability... yes checking grp.h presence... yes checking for grp.h... yes checking io.h usability... no checking io.h presence... no checking for io.h... no checking libutil.h usability... no checking libutil.h presence... no checking for libutil.h... no checking limits.h usability... yes checking limits.h presence... yes checking for limits.h... yes checking locale.h usability... yes checking locale.h presence... yes checking for locale.h... yes checking malloc.h usability... yes checking malloc.h presence... yes checking for malloc.h... yes checking for memory.h... (cached) yes checking psap.h usability... no checking psap.h presence... no checking for psap.h... no checking pwd.h usability... yes checking pwd.h presence... yes checking for pwd.h... yes checking process.h usability... no checking process.h presence... no checking for process.h... no checking sgtty.h usability... yes checking sgtty.h presence... yes checking for sgtty.h... yes checking shadow.h usability... yes checking shadow.h presence... yes checking for shadow.h... yes checking stddef.h usability... yes checking stddef.h presence... yes checking for stddef.h... yes checking for string.h... (cached) yes checking for strings.h... (cached) yes checking sysexits.h usability... yes checking sysexits.h presence... yes checking for sysexits.h... yes checking sys/file.h usability... yes checking sys/file.h presence... yes checking for sys/file.h... yes checking sys/filio.h usability... no checking sys/filio.h presence... no checking for sys/filio.h... no checking sys/fstyp.h usability... no checking sys/fstyp.h presence... no checking for sys/fstyp.h... no checking sys/errno.h usability... yes checking sys/errno.h presence... yes checking for sys/errno.h... yes checking sys/ioctl.h usability... yes checking sys/ioctl.h presence... yes checking for sys/ioctl.h... yes checking sys/param.h usability... yes checking sys/param.h presence... yes checking for sys/param.h... yes checking sys/privgrp.h usability... no checking sys/privgrp.h presence... no checking for sys/privgrp.h... no checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking sys/socket.h usability... yes checking sys/socket.h presence... yes checking for sys/socket.h... yes checking for sys/stat.h... (cached) yes checking sys/syslog.h usability... yes checking sys/syslog.h presence... yes checking for sys/syslog.h... yes checking sys/time.h usability... yes checking sys/time.h presence... yes checking for sys/time.h... yes checking for sys/types.h... (cached) yes checking sys/uio.h usability... yes checking sys/uio.h presence... yes checking for sys/uio.h... yes checking sys/vmount.h usability... no checking sys/vmount.h presence... no checking for sys/vmount.h... no checking syslog.h usability... yes checking syslog.h presence... yes checking for syslog.h... yes checking termios.h usability... yes checking termios.h presence... yes checking for termios.h... yes checking for unistd.h... (cached) yes checking utime.h usability... yes checking utime.h presence... yes checking for utime.h... yes checking for resolv.h... yes checking for netinet/tcp.h... yes checking for sys/ucred.h... no checking for sigaction... yes checking for sigset... yes checking for fmemopen... yes checking for socket... yes checking for select... yes checking for sys/select.h... (cached) yes checking for sys/socket.h... (cached) yes checking types of arguments for select... int,fd_set *,struct timeval * checking for poll... yes checking poll.h usability... yes checking poll.h presence... yes checking for poll.h... yes checking sys/poll.h usability... yes checking sys/poll.h presence... yes checking for sys/poll.h... yes checking sys/epoll.h usability... yes checking sys/epoll.h presence... yes checking for sys/epoll.h... yes checking for epoll system call... yes checking sys/event.h usability... no checking sys/event.h presence... no checking for sys/event.h... no checking sys/devpoll.h usability... no checking sys/devpoll.h presence... no checking for sys/devpoll.h... no checking for strerror... yes checking for strerror_r... yes checking non-posix strerror_r... no checking for regex.h... yes checking for library containing regfree... none required checking for compatible POSIX regex... yes checking sys/uuid.h usability... no checking sys/uuid.h presence... no checking for sys/uuid.h... no checking uuid/uuid.h usability... no checking uuid/uuid.h presence... no checking for uuid/uuid.h... no checking to see if -lrpcrt4 is needed for win32 UUID support... no checking for resolver link (default)... no checking for resolver link (-lresolv)... yes checking for hstrerror... yes checking for getaddrinfo... yes checking for getnameinfo... yes checking for gai_strerror... yes checking for inet_ntop... yes checking INET6_ADDRSTRLEN... yes checking struct sockaddr_storage... yes checking sys/un.h usability... yes checking sys/un.h presence... yes checking for sys/un.h... yes checking openssl/ssl.h usability... no checking openssl/ssl.h presence... no checking for openssl/ssl.h... no checking gnutls/gnutls.h usability... no checking gnutls/gnutls.h presence... no checking for gnutls/gnutls.h... no configure: WARNING: Could not locate TLS/SSL package configure: WARNING: TLS data protection not supported! checking for _beginthread... no checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking POSIX thread version... 10 checking for LinuxThreads pthread.h... no checking for GNU Pth pthread.h... no checking sched.h usability... yes checking sched.h presence... yes checking for sched.h... yes checking for pthread_create in default libraries... no checking for pthread link with -kthread... no checking for pthread link with -pthread... yes checking for sched_yield... yes checking for pthread_yield... yes checking for thr_yield... no checking for pthread_kill... yes checking for pthread_rwlock_destroy with <pthread.h>... yes checking for pthread_detach with <pthread.h>... yes checking for pthread_setconcurrency... yes checking for pthread_getconcurrency... yes checking for thr_setconcurrency... no checking for thr_getconcurrency... no checking for pthread_kill_other_threads_np... no checking for LinuxThreads implementation... no checking for LinuxThreads consistency... no checking if pthread_create() works... yes checking if select yields when using pthreads... yes checking for thread specific errno... yes checking for thread specific h_errno... yes checking for ctime_r... yes checking for gmtime_r... yes checking for localtime_r... yes checking for gethostbyname_r... yes checking for gethostbyaddr_r... yes checking number of arguments of ctime_r... 2 checking number of arguments of gethostbyname_r... 6 checking number of arguments of gethostbyaddr_r... 8 checking for openlog... yes checking sasl/sasl.h usability... no checking sasl/sasl.h presence... no checking for sasl/sasl.h... no checking sasl.h usability... no checking sasl.h presence... no checking for sasl.h... no configure: error: Could not locate Cyrus SASL Thanks in advance! -Narendra

3 2

./Configure failed on openldap
by Challa N Kumar Reddy 22 Sep '21

22 Sep '21

While performing the configure I am not able to pass. Please find the error shown below, Could you please advise on how to fix this. Thanks in advance. [nchalla@server openldap-2.5.7]$ ./configure --prefix=/u01/ldap --disable-static --enable-debug --with-tls=auto --with-cyrus-sasl --enable-dynamic --enable-crypt --enable-spasswd --enable-slapd --enable-modules --enable-rlookups --enable-backends=mod --disable-ndb --disable-sql --disable-shell --disable-bdb --disable-hdb --enable-overlays=mod configure: WARNING: unrecognized options: --disable-shell, --disable-bdb, --disable-hdb Configuring OpenLDAP 2.5.7-Release ... checking build system type... x86_64-pc-linux-gnu checking host system type... x86_64-pc-linux-gnu checking target system type... x86_64-pc-linux-gnu checking configure arguments... done checking for cc... cc checking for ar... ar checking for strip... strip checking whether make sets $(MAKE)... yes checking how to print strings... printf checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether cc accepts -g... yes checking for cc option to accept ISO C89... none needed checking for a sed that does not truncate output... /usr/bin/sed checking for grep that handles long lines and -e... /usr/bin/grep checking for egrep... /usr/bin/grep -E checking for fgrep... /usr/bin/grep -F checking for ld used by cc... /usr/bin/ld checking if the linker (/usr/bin/ld) is GNU ld... yes checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm -B checking the name lister (/usr/bin/nm -B) interface... BSD nm checking whether ln -s works... yes checking the maximum length of command line arguments... 1572864 checking how to convert x86_64-pc-linux-gnu file names to x86_64-pc-linux-gnu format... func_convert_file_noop checking how to convert x86_64-pc-linux-gnu file names to toolchain format... func_convert_file_noop checking for /usr/bin/ld option to reload object files... -r checking for objdump... objdump checking how to recognize dependent libraries... pass_all checking for dlltool... dlltool checking how to associate runtime and link libraries... printf %s\n checking for archiver @FILE support... @ checking for ranlib... ranlib checking for gawk... gawk checking command to parse /usr/bin/nm -B output from cc object... ok checking for sysroot... no checking for a working dd... /usr/bin/dd checking how to truncate binary pipes... /usr/bin/dd bs=4096 count=1 checking for mt... no checking if : is a manifest tool... no checking how to run the C preprocessor... cc -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking for dlfcn.h... yes checking for objdir... .libs checking if cc supports -fno-rtti -fno-exceptions... no checking for cc option to produce PIC... -fPIC -DPIC checking if cc PIC flag -fPIC -DPIC works... yes checking if cc static flag -static works... no checking if cc supports -c -o file.o... yes checking if cc supports -c -o file.o... (cached) yes checking whether the cc linker (/usr/bin/ld -m elf_x86_64) supports shared libraries... yes checking whether -lc should be explicitly linked in... no checking dynamic linker characteristics... GNU/Linux ld.so checking how to hardcode library paths into programs... immediate checking for shl_load... no checking for shl_load in -ldld... no checking for dlopen... no checking for dlopen in -ldl... yes checking whether a program can dlopen itself... yes checking whether a statically linked program can dlopen itself... yes checking whether stripping libraries is possible... yes checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... no checking how to run the C preprocessor... cc -E checking whether we are using MS Visual C++... no checking for windres... no checking for be_app in -lbe... no checking whether we are using the GNU C compiler... (cached) yes checking whether cc accepts -g... (cached) yes checking for cc option to accept ISO C89... (cached) none needed checking for cc depend flag... -M checking for afopen in -ls... no checking ltdl.h usability... yes checking ltdl.h presence... yes checking for ltdl.h... yes checking for lt_dlinit in -lltdl... yes checking for EBCDIC... no checking for ANSI C header files... yes checking for dirent.h that defines DIR... yes checking for library containing opendir... none required checking for sys/wait.h that is POSIX.1 compatible... yes checking whether termios.h defines TIOCGWINSZ... no checking whether sys/ioctl.h defines TIOCGWINSZ... yes checking arpa/inet.h usability... yes checking arpa/inet.h presence... yes checking for arpa/inet.h... yes checking arpa/nameser.h usability... yes checking arpa/nameser.h presence... yes checking for arpa/nameser.h... yes checking assert.h usability... yes checking assert.h presence... yes checking for assert.h... yes checking bits/types.h usability... yes checking bits/types.h presence... yes checking for bits/types.h... yes checking conio.h usability... no checking conio.h presence... no checking for conio.h... no checking crypt.h usability... yes checking crypt.h presence... yes checking for crypt.h... yes checking direct.h usability... no checking direct.h presence... no checking for direct.h... no checking errno.h usability... yes checking errno.h presence... yes checking for errno.h... yes checking fcntl.h usability... yes checking fcntl.h presence... yes checking for fcntl.h... yes checking filio.h usability... no checking filio.h presence... no checking for filio.h... no checking getopt.h usability... yes checking getopt.h presence... yes checking for getopt.h... yes checking grp.h usability... yes checking grp.h presence... yes checking for grp.h... yes checking io.h usability... no checking io.h presence... no checking for io.h... no checking libutil.h usability... no checking libutil.h presence... no checking for libutil.h... no checking limits.h usability... yes checking limits.h presence... yes checking for limits.h... yes checking locale.h usability... yes checking locale.h presence... yes checking for locale.h... yes checking malloc.h usability... yes checking malloc.h presence... yes checking for malloc.h... yes checking for memory.h... (cached) yes checking psap.h usability... no checking psap.h presence... no checking for psap.h... no checking pwd.h usability... yes checking pwd.h presence... yes checking for pwd.h... yes checking process.h usability... no checking process.h presence... no checking for process.h... no checking sgtty.h usability... yes checking sgtty.h presence... yes checking for sgtty.h... yes checking shadow.h usability... yes checking shadow.h presence... yes checking for shadow.h... yes checking stddef.h usability... yes checking stddef.h presence... yes checking for stddef.h... yes checking for string.h... (cached) yes checking for strings.h... (cached) yes checking sysexits.h usability... yes checking sysexits.h presence... yes checking for sysexits.h... yes checking sys/file.h usability... yes checking sys/file.h presence... yes checking for sys/file.h... yes checking sys/filio.h usability... no checking sys/filio.h presence... no checking for sys/filio.h... no checking sys/fstyp.h usability... no checking sys/fstyp.h presence... no checking for sys/fstyp.h... no checking sys/errno.h usability... yes checking sys/errno.h presence... yes checking for sys/errno.h... yes checking sys/ioctl.h usability... yes checking sys/ioctl.h presence... yes checking for sys/ioctl.h... yes checking sys/param.h usability... yes checking sys/param.h presence... yes checking for sys/param.h... yes checking sys/privgrp.h usability... no checking sys/privgrp.h presence... no checking for sys/privgrp.h... no checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking sys/socket.h usability... yes checking sys/socket.h presence... yes checking for sys/socket.h... yes checking for sys/stat.h... (cached) yes checking sys/syslog.h usability... yes checking sys/syslog.h presence... yes checking for sys/syslog.h... yes checking sys/time.h usability... yes checking sys/time.h presence... yes checking for sys/time.h... yes checking for sys/types.h... (cached) yes checking sys/uio.h usability... yes checking sys/uio.h presence... yes checking for sys/uio.h... yes checking sys/vmount.h usability... no checking sys/vmount.h presence... no checking for sys/vmount.h... no checking syslog.h usability... yes checking syslog.h presence... yes checking for syslog.h... yes checking termios.h usability... yes checking termios.h presence... yes checking for termios.h... yes checking for unistd.h... (cached) yes checking utime.h usability... yes checking utime.h presence... yes checking for utime.h... yes checking for resolv.h... yes checking for netinet/tcp.h... yes checking for sys/ucred.h... no checking for sigaction... yes checking for sigset... yes checking for fmemopen... yes checking for socket... yes checking for select... yes checking for sys/select.h... (cached) yes checking for sys/socket.h... (cached) yes checking types of arguments for select... int,fd_set *,struct timeval * checking for poll... yes checking poll.h usability... yes checking poll.h presence... yes checking for poll.h... yes checking sys/poll.h usability... yes checking sys/poll.h presence... yes checking for sys/poll.h... yes checking sys/epoll.h usability... yes checking sys/epoll.h presence... yes checking for sys/epoll.h... yes checking for epoll system call... yes checking sys/event.h usability... no checking sys/event.h presence... no checking for sys/event.h... no checking sys/devpoll.h usability... no checking sys/devpoll.h presence... no checking for sys/devpoll.h... no checking for strerror... yes checking for strerror_r... yes checking non-posix strerror_r... no checking for regex.h... yes checking for library containing regfree... none required checking for compatible POSIX regex... yes checking sys/uuid.h usability... no checking sys/uuid.h presence... no checking for sys/uuid.h... no checking uuid/uuid.h usability... no checking uuid/uuid.h presence... no checking for uuid/uuid.h... no checking to see if -lrpcrt4 is needed for win32 UUID support... no checking for resolver link (default)... no checking for resolver link (-lresolv)... yes checking for hstrerror... yes checking for getaddrinfo... yes checking for getnameinfo... yes checking for gai_strerror... yes checking for inet_ntop... yes checking INET6_ADDRSTRLEN... yes checking struct sockaddr_storage... yes checking sys/un.h usability... yes checking sys/un.h presence... yes checking for sys/un.h... yes checking openssl/ssl.h usability... no checking openssl/ssl.h presence... no checking for openssl/ssl.h... no checking gnutls/gnutls.h usability... no checking gnutls/gnutls.h presence... no checking for gnutls/gnutls.h... no configure: WARNING: Could not locate TLS/SSL package configure: WARNING: TLS data protection not supported! checking for _beginthread... no checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking POSIX thread version... 10 checking for LinuxThreads pthread.h... no checking for GNU Pth pthread.h... no checking sched.h usability... yes checking sched.h presence... yes checking for sched.h... yes checking for pthread_create in default libraries... no checking for pthread link with -kthread... no checking for pthread link with -pthread... yes checking for sched_yield... yes checking for pthread_yield... yes checking for thr_yield... no checking for pthread_kill... yes checking for pthread_rwlock_destroy with <pthread.h>... yes checking for pthread_detach with <pthread.h>... yes checking for pthread_setconcurrency... yes checking for pthread_getconcurrency... yes checking for thr_setconcurrency... no checking for thr_getconcurrency... no checking for pthread_kill_other_threads_np... no checking for LinuxThreads implementation... no checking for LinuxThreads consistency... no checking if pthread_create() works... yes checking if select yields when using pthreads... yes checking for thread specific errno... yes checking for thread specific h_errno... yes checking for ctime_r... yes checking for gmtime_r... yes checking for localtime_r... yes checking for gethostbyname_r... yes checking for gethostbyaddr_r... yes checking number of arguments of ctime_r... 2 checking number of arguments of gethostbyname_r... 6 checking number of arguments of gethostbyaddr_r... 8 checking for openlog... yes checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for WT... no configure: error: Package requirements (wiredtiger) were not met: Package 'wiredtiger', required by 'virtual:world', not found Consider adjusting the PKG_CONFIG_PATH environment variable if you installed software in a non-standard prefix. Alternatively, you may set the environment variables WT_CFLAGS and WT_LIBS to avoid the need to call pkg-config. See the pkg-config man page for more details.

2 1

Some problems while compiling + using openldap 2.5.7 ubuntu 20.04
by frederic.goudal＠bordeaux-inp.fr 22 Sep '21

22 Sep '21

Hello, I'm begining to migrate to openldap 2.5.7 So I did compile from source. I have had one difficulty while configuring : while running ./configure '--enable-overlays' '--enable-crypt' '--with-tls' '--enable-backends' '--with-cyrus-sasl' '--disable-ndb' '--enable-modules' I did got the following error : checking for WT... no configure: error: in `/home/sgoudal/openldap-2.5.7': configure: error: The pkg-config script could not be found or is too old. Make sure it is in your PATH or set the PKG_CONFIG environment variable to the full path to pkg-config. Alternatively, you may set the environment variables WT_CFLAGS and WT_LIBS to avoid the need to call pkg-config.checking for WT... no configure: error: in `/home/sgoudal/openldap-2.5.7': configure: error: The pkg-config script could not be found or is too old. Make sure it is in your PATH or set the PKG_CONFIG environment variable to the full path to pkg-config. Alternatively, you may set the environment variables WT_CFLAGS and WT_LIBS to avoid the need to call pkg-config. It took me a while to figure out what was WT (of course google does not help). Maybe a more explicit name like... wiredtiger.. could be more informative ? After correcting, compilation and installation went ok, but... /usr/local/libexec/slapd -VV /usr/local/libexec/slapd: error while loading shared libraries: libldap-2.5.so.0: cannot open shared object file: No such file or directory The library file is well located in /usr/local/lib adding LD_LIBRARY_PATH before running slapd correct the problem, (or CFLAGS=-L/usr/local/lib before ./configure) But it would be nice that it work out of the box.. or maybe I have missed something. -- Frédéric Goudal Administrateur Systèmes et Réseaux Bordeaux-INP

3 2

Re: Is there significance in overlay order in replicated environment
by Saša-Stjepan Bakša 22 Sep '21

22 Sep '21

> Lastbind functionality integrated partially? Nice! Where can I find > > documentation about it or a description on how to extract data for each > > user? > > > See the slapd.conf(5) man page. > > Ok I have found it, make it enabled and I can't find information where this attribute is shown. I searched through this man page and through the latest Admin guide but nothing points me in the direction of this attribute location. I can see that it is loaded with schema but no object class is using it. So I must be doing something wrong or I do not understand this mechanism. Also, in latest 2.5.7* olcLastBindPrecision* is not among list of possible attributes for mdb. I Have searched for it also but only olcLastBind is inherited from olcDatabaseConfig. *olcLastBind: TRUE | FALSE* Controls whether *slapd *will automatically maintain the pwdLastSuccess attribute for entries. By default, olcLastBind is FALSE. *olcLastBindPrecision: <number>* If olcLastBind is enabled, a new value is written only if the current one is more than *number *seconds in the past. Saša

2 3

Question mark (?) in search filters
by Ángel L. Mateo Martínez 21 Sep '21

21 Sep '21

Hello, I'm configuring an application using my openldap and I'm seeing queries I didn't know them before. The queries are like this: filter="(|(objectClass=groupOfNames)(?objectClass=container)(objectClass=organization)(objectClass=organizationalUnit)(objectClass=domain)(?objectClass=domaincomponent)(?objectClass=builtinDomain))" This may be the first time I see the ? in the search filter of a query. But when I try to reproduce it with ldapsearch command I get: $ ldapsearch '(|(objectClass=groupOfNames)(?objectClass=container)(objectClass=organization)(objectClass=organizationalUnit)(objectClass=domain)(?objectClass=domaincomponent)(?objectClass=builtinDomain))' # extended LDIF # # LDAPv3 # base <dc=Telematica> (default) with scope subtree # filter: (|(objectClass=groupOfNames)(?objectClass=container)(objectClass=organization)(objectClass=organizationalUnit)(objectClass=domain)(?objectClass=domaincomponent)(?objectClass=builtinDomain)) # requesting: ALL # ldap_search_ext: Bad search filter (-7) I guess the problem in the query is because of the '?' operator. So, how can I reproduce it with ldapsearch? And... what does this '?' mean? Thanks, --- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868889150 Fax: 868888337

2 1

Re: Is there significance in overlay order in replicated environment
by Saša-Stjepan Bakša 20 Sep '21

20 Sep '21

> > > Yes, it matters. Syncprov first, then accesslog. After that order should > be immaterial. > > I would note that in OpenLDAP 2.5, a bit of the lastbind functionality has > been integrated into slapd so you may not need to deploy it separately. > > --Quanah > > > I thought so but wasn't sure. Thank you for your confirmation. Lastbind functionality integrated partially? Nice! Where can I find documentation about it or a description on how to extract data for each user? Saša

2 1

Syncrepl failing after a while
by Mircea Baciu 20 Sep '21

20 Sep '21

Hi, I have an issue with a consumer replication starting to fail until OpenLDAP is restarted. My setup consists of a pair of on-prem MirrorMode replicated providers (only one is active at a given time using a virtual IP managed by Keepalived), and one off-site (AWS) consumer. The providers use a dedicated port (LDAPS on 1636) for their own replication, as well as for the consumer to connect to them, so the consumer has access to both servers, regardless of where the providers' virtual IP is residing. All the connections happen over LDAPS, and the syncrepl configs have the tls_reqcert=allow option. The providers are always in sync and I'm able to switch make one or the other one the "active" one with ease. The consumer does the initial sync and stays in sync for a while, but I find it often (almost daily) out of sync. I see error messages on both the consumer and provider side: On the consumer (every minute): Sep 20 08:19:31 <consumer> slapd[1440]: slap_client_connect: URI=ldaps://<provider1>:1636/ DN="uid=replication,ou=sysaccounts,dc=example,dc=com" ldap_sasl_bind_s failed (-1) Sep 20 08:19:31 <consumer> slapd[1440]: do_syncrepl: rid=001 rc -1 retrying Sep 20 08:19:31 <consumer> slapd[1440]: slap_client_connect: URI=ldaps://<provider2>:1636/ DN="uid=replication,ou=sysaccounts,dc=example,dc=com" ldap_sasl_bind_s failed (-1) Sep 20 08:19:31 <consumer> slapd[1440]: do_syncrepl: rid=002 rc -1 retrying Sep 20 08:20:31 <consumer> slapd[1440]: slap_client_connect: URI=ldaps://<provider1>:1636/ DN="uid=replication,ou=sysaccounts,dc=example,dc=com" ldap_sasl_bind_s failed (-1) Sep 20 08:20:31 <consumer> slapd[1440]: do_syncrepl: rid=001 rc -1 retrying Sep 20 08:20:31 <consumer> slapd[1440]: slap_client_connect: URI=ldaps://<provider2>:1636/ DN="uid=replication,ou=sysaccounts,dc=example,dc=com" ldap_sasl_bind_s failed (-1) Sep 20 08:20:31 <consumer> slapd[1440]: do_syncrepl: rid=002 rc -1 retrying On the provider (every minute): Sep 20 08:19:31 <provider1> slapd[1057]: conn=11242 fd=14 ACCEPT from IP=<consumer IP>:45438 (IP=<provider1 IP>:1636) Sep 20 08:19:31 <provider1> slapd[1057]: conn=11242 fd=14 TLS established tls_ssf=256 ssf=256 Sep 20 08:19:31 <provider1> slapd[1057]: conn=11242 fd=14 closed (connection lost) Sep 20 08:20:31 <provider1> slapd[1057]: conn=11243 fd=14 ACCEPT from IP=<consumer IP>:45458 (IP=<provider1 IP>:1636) Sep 20 08:20:31 <provider1> slapd[1057]: conn=11243 fd=14 TLS established tls_ssf=256 ssf=256 Sep 20 08:20:31 <provider1> slapd[1057]: conn=11243 fd=14 closed (connection lost) Sep 20 08:19:31 <provider2> slapd[1051]: conn=215893 fd=18 ACCEPT from IP=<consumer IP>:41706 (IP=<provider2 IP>:1636) Sep 20 08:19:31 <provider2> slapd[1051]: conn=215893 fd=18 TLS established tls_ssf=256 ssf=256 Sep 20 08:19:31 <provider2> slapd[1051]: conn=215893 fd=18 closed (connection lost) Sep 20 08:20:31 <provider2> slapd[1051]: conn=215898 fd=18 ACCEPT from IP=<consumer IP>:41726 (IP=<provider2 IP>:1636) Sep 20 08:20:31 <provider2> slapd[1051]: conn=215898 fd=18 TLS established tls_ssf=256 ssf=256 Sep 20 08:20:31 <provider2> slapd[1051]: conn=215898 fd=18 closed (connection lost) There must be something wrong on the consumer side since when the issue starts, the consumer is not able to connect to either provider. Once I restart the consumer, it quickly resyncs and works just fine, for a while. The providers are OpenLDAP 2.4.44 (openldap-2.4.44-24.el7_9.x86_64), running on RHEL 7. The consumer is OpenLDAP 2.4.44 (openldap-2.4.44-24.el7_9.x86_64), running on CentOS 7. The consumer syncrepl config is: olcSyncrepl: {0}rid=001 provider=ldaps://<provider1>:1636/ searchbase="dc=example,dc=com" type=refreshAndPersist retry="60 +" timeout=1 bindmethod=simple binddn="uid=replication,ou=SysAccounts,dc=example,dc=com" credentials=<credentials> tls_reqcert=allow olcSyncrepl: {1}rid=002 provider=ldaps://<provider1>:1636/ searchbase="dc=example,dc=com" type=refreshAndPersist retry="60 +" timeout=1 bindmethod=simple binddn="uid=replication,ou=SysAccounts,dc=example,dc=com" credentials=<credentials> tls_reqcert=allow The "uid=replication,ou=SysAccounts,dc=example,dc=com" DN has full read-only permissions for the entire "dc=example,dc=com" tree. Any idea on what might be my issue here? Thank you, Mircea -- Mircea Baciu | Senior Unix Systems Administrator Simmons University | 300 The Fenway | Boston, MA 02115 | 617-521-2194

3 3

Re: Syncrepl failing after a while
by Mircea Baciu 20 Sep '21

20 Sep '21

Thank you, Quanah, I didn't know about the "keepalive" option for syncrepl. Now that you mentioned, I found some old 2017 discussion on this list with a very similar issue I have, where you mentioned this option. I see it in the slapd manual page but not on 2.4 (or 2.5) admin site: https://www.openldap.org/doc/admin24/replication.html I'll try adding it to the config and will definitely consider upgrading to a newer version in some fashion. Thanks, Mircea -- Mircea Baciu | Senior Unix Systems Administrator Simmons University | 300 The Fenway | Boston, MA 02115 | 617-521-2194 On Mon, Sep 20, 2021 at 11:12 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Monday, September 20, 2021 11:38 AM -0400 Mircea Baciu > <mircea.baciu(a)simmons.edu> wrote: > > > > The providers are OpenLDAP 2.4.44 (openldap-2.4.44-24.el7_9.x86_64), > > running on RHEL 7. > > The consumer is OpenLDAP 2.4.44 (openldap-2.4.44-24.el7_9.x86_64), > > running on CentOS 7. > > > Hello, > > The OpenLDAP 2.4.44 release is over 5 years old and numerous replication > related issues have been fixed since that time. Additionally, RedHat is > known to have made questionable modifications to libldap, particularly > around the TLS layer in RHEL7. > > I'd strongly advise you to upgrade to a current release of OpenLDAP. I > would note that Symas provides free drop-in replacement builds of OpenLDAP > for RHEL7 with optional support available > (<https://repo.symas.com/sofl/rhel7/>). > > Symas also provides free builds of the current OpenLDAP release series > (2.5) with optional support available > (<https://repo.symas.com/soldap/rhel7/>). > > I'd also note that your syncrepl stanza is missing the "keepalive" option, > which is usually essential when dealing with traffic through load > balancers. > > Regards, > Quanah > > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Is there significance in overlay order in replicated environment
by Saša-Stjepan Bakša 20 Sep '21

20 Sep '21

Hi, I am moving my old LDAP setup which is now more than 8 years old to version 2.5.7 (Symas Ubuntu build). Now I use simple Master -> backup only sync configuration. On those systems I also use accesslog overlay. On new systems I would like to deploy a multi master with delta sync or maybe pure multi master since it is a small database with only few hundreds users. I have been using multi master on other systems for years without any (many) problems and those systems have more that 500 k users. Also I would like to use accesslog and lastbind overlays and maybe some other overlays in the future. My question is is there significance in which order I will add overlays to databases? Syncprov first then others or it does not have any impact. Br Saša

2 1

OpenLDAP 2.6.0 testing call
by Quanah Gibson-Mount 16 Sep '21

16 Sep '21

This is the first testing call for OpenLDAP 2.6.0 Release. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. A list of items fixed and added in 2.6 can be found at: <https://bugs.openldap.org/buglist.cgi?bug_status=RESOLVED&bug_status=VERIFI…> A major change with 2.6 is the ability to bypass syslog for logging (ITS#6949). This significantly improves slapd performance. Currently this is being adjusted so that lloadd also supports this new feature, but it can be tested with slapd at this time. Additionally, the following deprecated backends have been removed: back-ndb back-shell Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

7 14

How to create an entry, which is not returned on SEARCH
by Дилян Палаузов 15 Sep '21

15 Sep '21

Hello, How can I create an entry (in terms of ldif/ldapadd/ldapmodify), which is not returned on searches (apart from tweaking the olcAccess rules? https://www.openldap.org/devel/admin/replication.html says: > Because a general search filter can be used in the syncrepl specification, some entries in the context may be omitted from the synchronization content. The syncrepl engine creates a glue entry to fill in the holes in the replica context if any part of the replica content is subordinate to the holes. The glue entries will not be returned in the search result unless ManageDsaIT control is provided. Rationale: I want to create a directory, containing contacts under: cn=juridical persons,dc=me cn=natural persons,dc=me The LDAP clients shall query base dc=me with scope SUB. The LDAP clients shall see all subentries of Juridical Persons and all subentries of Natural Persons, but not the cn=juridical persons,dc=me cn=natural persons,dc=me and dc=me entries itself. As the latter entries do not represent Contacts (mail, phone, address), the entries shall not appear in address books. Greetings Дилян

3 2

openldap and oauth2
by Stefan Kania 14 Sep '21

14 Sep '21

Hello to all, short question. Is OpenLDAP supporting oauth2? If yes, can some one point me to a howto? Stefan

2 1

Checking synchronization status into cn=monitor in OpenLDAP 2.5
by David Coutadeur 08 Sep '21

08 Sep '21

Hi, I am trying to get the synchronization status of a given consumer for each of his declared provider. Synchronization status = Is this provider synchronized with the current consumer? (TRUE / FALSE) Currently, I can do that by comparing contextCSN stored into consumers and providers. I have noted that in OpenLDAP 2.5 there are new piece of information into cn=monitor: |dn: cn=Consumer 000,cn=Database 1,cn=Databases,cn=Monitor objectClass: olmSyncReplInstance structuralObjectClass: olmSyncReplInstance cn: Consumer 000 creatorsName: cn=monitor modifiersName: cn=monitor createTimestamp: 20210908075111Z modifyTimestamp: 20210908075111Z olmSRProviderURIList: ldap://localhost:3389 olmSRConnection: IP=127.0.0.1:40908 olmSRSyncPhase: Persist olmSRNextConnect: 00000101000000Z olmSRLastConnect: 20210908075211Z olmSRLastContact: 20210908082522Z olmSRLastCookieRcvd: rid=000,csn=20210908082522.652290Z#000000#000#000000 olmSRLastCookieSent: rid=000,sid=000,csn=20210907161949.876119Z#000000#000#000 000 entryDN: cn=Consumer 000,cn=Database 1,cn=Databases,cn=Monitor subschemaSubentry: cn=Subschema hasSubordinates: FALSE| 1/ I haven't found any documentation about these attributes in OpenLDAP manual. Is there something in progress ? 2/ if I understand correctly the meaning of olmSRLastCookieRcvd, it should be the best candidate for computing the synchronization status. However, this attribut is empty at OpenLDAP startup, so I can't really rely on it. Do anyone see other means to get the synchronization status? Regards, David

2 1

Re: OpenLDAP 2.6.0 testing call
by Nick Folino 07 Sep '21

07 Sep '21

No issues on Fedora 34. Any docs on how to work with the new logging options? Nick On Tue, Sep 7, 2021 at 1:01 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > This is the first testing call for OpenLDAP 2.6.0 Release. Depending on > the results, this may be the only testing call. > > Generally, get the code for RE26: > > < > https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o… > > > > Extract, configure, and build. > > Execute the test suite (via make test) after it is built. Optionally, cd > tests && make its to run through the regression suite. > > A list of items fixed and added in 2.6 can be found at: > > < > https://bugs.openldap.org/buglist.cgi?bug_status=RESOLVED&bug_status=VERIFI… > > > > A major change with 2.6 is the ability to bypass syslog for logging > (ITS#6949). This significantly improves slapd performance. Currently > this > is being adjusted so that lloadd also supports this new feature, but it > can > be tested with slapd at this time. > > Additionally, the following deprecated backends have been removed: > > back-ndb > back-shell > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Issue with building of back-perl
by bourguijl＠gmail.com 07 Sep '21

07 Sep '21

Dears, I try to compile 2.5.7 version with --enable-perl module but I get issue as following : First issue I get : In file included from init.c:18: perl_back.h:21:10: fatal error: EXTERN.h: No such file or directory #include <EXTERN.h> ^~~~~~~~~~ compilation terminated. make[3]: *** [Makefile:334: init.lo] Error 1 To solve above issue, I had to install a missing rehl package (perl-devel.x86_64) and set CPPFLAGS=-I/usr/lib64/perl5/CORE/ of the "configure utility". I did : Make distclean Configure Make depend make Then "make" goes further but now I get a lot of entries as below then it stopped : libtool: link: cc -g -O2 .libs/slapdS.o -o .libs/slapd main.o globals.o bconfig.o config.o daemon.o connection.o search.o filter.o add.o cr.o attr.o entry.o backend.o backends.o result.o operation.o dn.o compare.o modify.o delete.o modrdn.o ch_malloc.o value.o ava.o bind.o unbind.o abandon.o filterentry.o phonetic.o acl.o str2filter.o aclparse.o init.o user.o lock.o controls.o extended.o passwd.o proxyp.o schema.o schema_check.o schema_init.o schema_prep.o schemaparse.o ad.o at.o mr.o syntax.o oc.o saslauthz.o oidm.o starttls.o index.o sets.o referral.o root_dse.o sasl.o module.o mra.o mods.o sl_malloc.o zn_malloc.o limits.o operational.o matchedValues.o cancel.o syncrepl.o backglue.o backover.o ctxcsn.o ldapsync.o frontend.o slapadd.o slapcat.o slapcommon.o slapdn.o slapindex.o slappasswd.o slaptest.o slapauth.o slapacl.o component.o aci.o txn.o slapschema.o slapmodify.o version.o -pthread -Wl,--export-dynamic libbackends.a liboverlays.a ../../libraries/liblunicode/liblunicode.a ../../libraries/librewrite/librewrite.a ../../libraries/liblutil/liblutil.a ../../libraries/libldap/.libs/libldap.so /usr/app/LDAP/binaries/openldap-2.5.7/libraries/liblber/.libs/liblber.so ../../libraries/liblber/.libs/liblber.so -lltdl -lresolv -pthread -Wl,-rpath -Wl,/usr/app/LDAP/binaries/openldap-2.5.7/lib libbackends.a(perlinit.o): In function `perl_back_xs_init': /usr/app/LDAP/binaries/openldap-2.5.7/servers/slapd/back-perl/init.c:166: undefined reference to `boot_DynaLoader' libbackends.a(perlinit.o): In function `perl_back_db_open': /usr/app/LDAP/binaries/openldap-2.5.7/servers/slapd/back-perl/init.c:135: undefined reference to `Perl_push_scope' /usr/app/LDAP/binaries/openldap-2.5.7/servers/slapd/back-perl/init.c:135: undefined reference to `Perl_savetmps' /usr/app/LDAP/binaries/openldap-2.5.7/servers/slapd/back-perl/init.c:142: undefined reference to `Perl_call_method' /usr/app/LDAP/binaries/openldap-2.5.7/servers/slapd/back-perl/init.c:152: undefined reference to `Perl_pop_scope' /usr/app/LDAP/binaries/openldap-2.5.7/servers/slapd/back-perl/init.c:150: undefined reference to `Perl_sv_2iv_flags' /usr/app/LDAP/binaries/openldap-2.5.7/servers/slapd/back-perl/init.c:152: undefined reference to `Perl_free_tmps' /usr/app/LDAP/binaries/openldap-2.5.7/servers/slapd/back-perl/init.c:137: undefined reference to `Perl_markstack_grow' /usr/app/LDAP/binaries/openldap-2.5.7/servers/slapd/back-perl/init.c:138: undefined reference to `Perl_stack_grow' /usr/app/LDAP/binaries/openldap-2.5.7/servers/slapd/back-perl/init.c:147: undefined reference to `Perl_croak_nocontext' libbackends.a(perlinit.o): In function `perl_back_initialize': /usr/app/LDAP/binaries/openldap-2.5.7/servers/slapd/back-perl/init.c:91: undefined reference to `Perl_sys_init3' /usr/app/LDAP/binaries/openldap-2.5.7/servers/slapd/back-perl/delete.c:28: undefined reference to `Perl_croak_nocontext' collect2: error: ld returned 1 exit status make[2]: *** [Makefile:527: slapd] Error 1 make[2]: Leaving directory '/usr/app/LDAP/binaries/openldap-2.5.7/servers/slapd' make[1]: *** [Makefile:300: all-common] Error 1 make[1]: Leaving directory '/usr/app/LDAP/binaries/openldap-2.5.7/servers' make: *** [Makefile:321: all-common] Error 1 Here is my configure command which works fine without “—enable-perl” : ./configure --prefix=/usr/app/LDAP/binaries/openldap-2.5.7/ --sysconfdir=/usr/app/LDAP/binaries/openldap-2.5.7 --mandir=/usr/local/share/man --enable-modules --enable-ldap --enable-dynlist --enable-ppolicy --enable-unique --with-gnu-ld --enable-refint --with-tls --enable-dynamic --enable-valsort --enable-rwm --enable-perl Any idea of what's the issue ? THx, Jean-Luc.

2 3

Can expensive write-related ACL checks somehow be avoided when a client only wants to read?
by haraldme＠gmail.com 06 Sep '21

06 Sep '21

Hi, we’re trying to (re-)implement some rather complicated ACLs, and are running into performance troubles. Thing is, the ACLs are only (or at least mostly) complicated in the “I want to update stuff” case; read access is relatively straightforward. For example, we have some group entries with lots of members, and want any authenticated user to be allowed to read those - but to update a group, you’ll have to both be in the “write allowed set" for the group and for the entries of the member DNs you’re touching. You’re in the “write allowed set” of an entry if 1) you’re a ‘member' of the group who is ‘manager’ for the entry, 2) as 1, but allow recursive groups, 3) you’re a ‘member’ of the group who is ‘manager’ for the entry’s ‘owner’, 4) as 3, but allow recursive groups, 5) as 3-4, but also allow recursive ‘owner’, or 6) if neither the entry nor any of its recursive owners has any ‘manager’ (and you have the “allow writes to unprotected entries” general access). This is implemented as ACLs akin to this: access to dn.subtree=“$our_root" attrs=@ourDistinguishedNameAttrs val.regex="^(.+)$$" by set.expand="( [${v1}]/manager*/member* | [${v1}]/manager* ) & user" break by set.expand="[${v1}]/manager" read stop by set.expand="[${v1}]/owner*/manager*/member* & user" break by set.expand="[${v1}]/owner*/manager" read stop by set.expand="[${v1}]/objectClass" break by * -a continue by * +z break … which /works/, but performs rather badly when someone e.g. tries to read a group with hundreds of ‘member’ attributes. Is there some feature I’m missing, or some way we can organize the ACLs, so that LDAP operations that only need read access won’t have to do the expensive write-protection checks? Best regards -- Harald Meland

1 0

In LMDB the maximum number of pages is less than the sum of free and used pages?
by Дилян Палаузов 05 Sep '21

05 Sep '21

Hello, I want to monitor the MDB storage for being too full, and enlarge it manually if necessary. https://ltb-project.org/documentation/nagios-plugins/check_lmdb_usage can do such monitoring. It calls mdb_stat -fe , parses the lines Max pages: 2560 Number of pages used: 2559 Free pages: 54 extracts the numbers and calculates either the percent ($pages_used / $max_pages * 100) or ($pages_free / $max_pages * 100 ) As can be seen in this expamle, the maximum number of pages is less than the sum of free and used pages. Shall the database be enlarged, when ($pages_used / $max_pages * 100) gets too high, or when ($pages_free / $max_pages * 100 ) gets too low? Greetings Дилян

1 0

LMDB: Ask for help with debugging MDB_MAP_FULL
by libor.peltan＠nic.cz 02 Sep '21

02 Sep '21

Hi, I'm struggling with an issue that a large, but mostly free LMDB database is claiming MDB_MAP_FULL when trying to store a large write transaction. The LMDB mapsize is configured to 40 GiB and indeed, the database (data.mdb) already has this size. Thus, it cannot grow. mdb_stat says: Status of Main DB Tree depth: 3 Branch pages: 24 Leaf pages: 1123 Overflow pages: 152153 Entries: 27423 Computing [ (branch + leaf + overflow) * page_size ] (I assume page_size is 4 KiB) leads to only ~600 MiB of the real database usage, which corresponds to the estimated amount of data stored there. So the database is used by just 1.5% and ought to have plenty free space inside. The write attempt that fails, tries to insert 700 MiB more data in one transaction, still just small percentage of the mapsize. However, this fails with MDB_MAP_FULL. Note that our application stores such large data in the way that it splits them into small chunks (~70 KiB each) and stores them as many key-value records. This is done to avoid issues with searching for too large continuous free space. I have tracked down one such failing write attempt with gdb to see what exactly fails: #0 mdb_page_alloc (mc=0x7fffd7e9fa08, num=8, mp=0x7fffd7e9f518) at contrib/lmdb/mdb.c:2286 #1 0x00000000004e2cf6 in mdb_page_new (mc=0x7fffd7e9fa08, flags=4, num=8, mp=0x7fffd7e9f578) at contrib/lmdb/mdb.c:7178 #2 0x00000000004e6108 in mdb_node_add (mc=0x7fffd7e9fa08, indx=98, key=0x7fffd7e9fc08, data=0x7fffd7e9fc20, pgno=0, flags=65536) at contrib/lmdb/mdb.c:7320 #3 0x00000000004de628 in mdb_cursor_put (mc=0x7fffd7e9fa08, key=0x7fffd7e9fc08, data=0x7fffd7e9fc20, flags=65536) at contrib/lmdb/mdb.c:6947 #4 0x00000000004e830a in mdb_put (txn=0x7fffd000cd80, dbi=1, key=0x7fffd7e9fc08, data=0x7fffd7e9fc20, flags=65536) at contrib/lmdb/mdb.c:9022 It shows an unsuccessful attempt to allocate 8 pages (interestingly, quite a little amount, since it had allocated a lot of 20-paged chunks just before). Tracking down the LMDB source code I found this interesting line: https://git.openldap.org/openldap/openldap/-/blob/master/libraries/liblmdb/… Unfortunately, I have not enough insight to understand mdb_page_alloc() in its complexity, but this seems like a kind of heurstics. It limits the number of scanned fragments of free space (for unknown reason). In the past, it has also been "tuned": https://git.openldap.org/openldap/openldap/-/commit/5ee99f1125a775f28ed69b0… I tried to patch my copy of LMDB source code by doubling this magic constant (60 -> 120), and voila, this particular write transaction succeeded afterwards. However, this is obvoiusly no sustainable way of sorting this out. What is interesting to me is that the number of retries relies only on the size of the allocated chunk (number of pages to alloc), but not the mapsize. It seems possible to me that in a huge database, there might probably be a lot of tiny (e.g. one-page) fragments of free space, that need to be skipped before finding any large-enough one. However, I don't yet dare to create an issue on this. Could you please tell me if my thoughts lead some proper, or some wrong way? Does LMDB need some improvement to avoid this (and similar) issues? Do you think that chunking the large data to even smaller parts (70 KiB -> 3 KiB) by our application could be more clever to reduce fragmentation of overflow-pages-space in LMDB? Thank you for any hints and more insight to LMDB internals. Many cheers, Libor Knot DNS | CZ NIC

1 0

Support for member;range=0-1499
by shekhar.shrinivasan＠gmail.com 01 Sep '21

01 Sep '21

Hi, Does openLDAP support searching with "member;range=0-1499" ? We have a back_meta configured in front of AD and when we try to search for a group having more than 1500 members using the following filter - ldapsearch -LLL -h <hostname> -p <port> -D <user dn> -w -s sub -b <basedn> '(cn=<group-dn>)' 'member;range=0-1499' we get the error as seen below - slap_bv2undef_ad(member;range=0-1499): AttributeDescription contains inappropriate characters. Any pointers ? Thanks for your help !

2 2

migrate from slapo-memberof to slapo-dynlist
by Michael Ströder 31 Aug '21

31 Aug '21

HI! It's easy to change the config of OpenLDAP 2.5 from "overlay memberof" to "overlay dynlist" and it just works. Nice. :-) But the existing database then still contains the 'memberOf' attribute values. Ideally one should reload the database. But if anything fails: Does it do any harm if 'memberOf' attribute values are still present in the database but slapo-dynlist is supposed to compute 'memberOf' attribute values based on recently changed group membership? At the end I will instruct the admins to reload databases especially to also save space. But it would be less operational stress if I could decouple the config change from the database re-load. Ciao, Michael.

2 3

Re: 2.5.7 - adding memberof module Duplicate attributeType
by Saša-Stjepan Bakša 30 Aug '21

30 Aug '21

On Mon, 30 Aug 2021 at 19:33, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > > @Dave Macias Can you share the structure of your groups? > > member/memberOf depend on LDAP groups, not unix groups, which are based on > DNs. > > Example groups objectClasses are: > > groupOfNames (core schema) > groupOfUniqueNames (core schema) > groupOfMembers (rfc2307bis schema) > > > Of these three, I would recommend either groupOfNames or groupOfMembers > > Thank you Quanah! I will try them as you suggested. br Saša

1 0

Re: 2.5.7 - adding memberof module Duplicate attributeType
by Quanah Gibson-Mount 30 Aug '21

30 Aug '21

--On Monday, August 30, 2021 8:26 PM +0200 Saša-Stjepan Bakša <ssbaksa(a)gmail.com> wrote: > --On Monday, August 30, 2021 11:14 AM +0200 Saša-Stjepan Bakša > <ssbaksa(a)gmail.com> wrote: > >> I have similar situation and also a replicated environment. I am using >> posixGroup only and never had any need for a memberOf attribute. >> But now, my devs have a software which insists on that attribute so I >> should provide it for them. > > posixGroup is not a valid objectClass to use with providing memberOf > information. > > --Quanah > > > > > > Ouch! I have 51 different posixGroup groups which have been in use for > more than 10 years and now because of one > piece of software I must change the way I manage them all. Not happy at > all. > > > What is your suggestion Quanah? Can I just add an object? It would be a > problem if I must change all services. > Or maybe just add a few new groups of different types for that software. > That will be great if it is appropriate. > > > > @Dave Macias Can you share the structure of your groups? member/memberOf depend on LDAP groups, not unix groups, which are based on DNs. Example groups objectClasses are: groupOfNames (core schema) groupOfUniqueNames (core schema) groupOfMembers (rfc2307bis schema) Of these three, I would recommend either groupOfNames or groupOfMembers Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: OpenLDAP 2.5.7 dies
by kevin martin 30 Aug '21

30 Aug '21

https://bugs.openldap.org/show_bug.cgi?id=9656 --- Regards, Kevin Martin On Mon, Aug 30, 2021 at 10:01 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Monday, August 30, 2021 10:41 AM -0500 kevin martin <ktmdms(a)gmail.com> > > wrote: > > > > > > > issue handled. missing pwdCheckModuleArg in the password policy > > (apparently not using ppm.conf anymore). once added to the schema the > > password change works. > > This still should not cause slapd to crash. Please file a bug at > https://bugs.openldap.org with the reproduction steps. Thanks! > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Re: 2.5.7 - adding memberof module Duplicate attributeType
by Dave Macias 30 Aug '21

30 Aug '21

Thank you for the input! Ive been researching it a bit. As far as I understand, dynlist “allows for expansion of dynamic groups and more” (from the man). Also, I'm assuming that dynlist also works well with MMR syncrepl, yes? (Since memberof didnt) I only have static groups. Googling around showed that you can also use it against static groups…if I understood it correctly. Would this overlay config help me for expanding against static groups using rfc2307bis schema? dn: olcOverlay=dynlist,olcDatabase=mdb,cn=config objectClass: olcOverlayConfig objectClass: olcDynListConfig olcOverlay: dynlist olcDynListAttrSet: member Thank you! On Aug 27, 2021, 8:39 PM -0400, Quanah Gibson-Mount <quanah(a)symas.com>, wrote: --On Friday, August 27, 2021 8:10 PM -0400 Dave Macias <davama(a)gmail.com> wrote: So i rebuild but without memberof module/overlay From the slapo-memberof(5) man page for OpenLDAP 2.5: Note that this overlay is deprecated and support will be dropped in future OpenLDAP releases. Installations should use the dynlist overlay instead. Using this overlay in a replicated environment is especially discouraged. The point was you should be using dynlist rather than memberOf. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 4

Re: OpenLDAP 2.5.7 dies
by kevin martin 30 Aug '21

30 Aug '21

issue handled. missing pwdCheckModuleArg in the password policy (apparently not using ppm.conf anymore). once added to the schema the password change works. --- Regards, Kevin Martin On Fri, Aug 27, 2021 at 7:42 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Friday, August 27, 2021 5:47 PM -0500 kevin martin <ktmdms(a)gmail.com> > > wrote: > > > > > > > Howard, I DID use ppm in 2.4 and there's a compile warning with ppm in > > that: > > If you are using OpenLDAP 2.5, then you should be compiling the version of > the ppm module that ships with it in contrib/slapd-modules/ppm. Or to be > more clear, all modules you're using should be the 2.5 versions of the > modules and not the 2.4 versions. I.e., same deal with the ppolicy > overlay. > > Please provide your ppolicy configuration (for the ppolicy overlay), both > the configuration from slapd.conf/cn=config AND the LDIF entry for > whatever > you have defined the default policy to be or whatever policy it is that > applies to the entries you are modifying. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Re: OpenLDAP 2.5.7 dies
by kevin martin 28 Aug '21

28 Aug '21

Howard, I DID use ppm in 2.4 and there's a compile warning with ppm in that: ppm]# make gcc -g -O2 -fpic -DDEBUG -DCRACKLIB -c -I../../../include -I../../../include -I../../../servers/slapd ppm.c In function ‘strcpy_safe.part.1’, inlined from ‘strcpy_safe’ at ppm.c:57:1: ppm.c:68:9: warning: ‘strncpy’ specified bound depends on the length of the source argument [-Wstringop-overflow=] strncpy(dest, src, n); ^~~~~~~~~~~~~~~~~~~~~ ppm.c: In function ‘strcpy_safe’: ppm.c:65:26: note: length computed here int length_src = strlen(src); ^~~~~~~~~~~ gcc -I../../../include -I../../../include -I../../../servers/slapd -shared -o ppm.so ppm.o -lcrack gcc -g -O2 -fpic -I../../../include -I../../../include -I../../../servers/slapd -L../../../libraries/liblber/.libs -L../../../libraries/libldap/.libs -lldap -llber -Wl,-rpath=. -o ppm_test ppm_test.c ppm.so -L../../../libraries/liblber/.libs -L../../../libraries/libldap/.libs -lldap -llber -lcrack as for the entire thread dump, here it is with a different password than the one I was trying to change it to but that still caused the crash: Thread 3 "slapd" received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7ff8cff03700 (LWP 132587)] check_password (pPasswd=0x7ff8c011bb81 "0penLD@p!1s@paiN!nth3@aSs!", ppErrStr=0x7ff8cff01fd0, e=0x7ff8c0001c68, pArg=0x0) at ppm.c:444 444 ppm_log(LOG_NOTICE, "ppm: RAW configuration: %s", (gdb) thr apply all bt full Thread 3 (Thread 0x7ff8cff03700 (LWP 132587)): #0 check_password (pPasswd=0x7ff8c011bb81 "0penLD@p!1s@paiN!nth3@aSs!", ppErrStr=0x7ff8cff01fd0, e=0x7ff8c0001c68, pArg=0x0) at ppm.c:444 pEntry = 0x7ff8c0001c68 pwdCheckModuleArg = 0x0 szErrStr = 0x7ff8c0103220 "" mem_len = <optimized out> numParam = 32760 useCracklib = <optimized out> cracklibDict = '\000' <repeats 32 times>, "\002\000\000\000\000\000\000\000Hcq\024\371\177\000\000\020\000\000\000\000\000\000\000h\000\000\000\000\000\000\000\000rq\024\371\177\000\000\060\245\021\300\370\177\000\000\060\245\021\300\370\177\000\000\020\000\000\000\000\000\000\000Y\324\020\300\370\177\000\000Ф\021\300\370\177\000\000\220\323\020\300\370\177\000\000У\021\300\370\177\000" cracklibDictFiles = {'\000' <repeats 132 times>, '\000' <repeats 132 times>, '\000' <repeats 132 times>} cracklibExt = {0x7ff914a433a0 <aesni_256_gcm> "\205\003", 0x7ff8cfeef700 "K", 0x4b <error: Cannot access memory at address 0x4b>} fd = <optimized out> res = <optimized out> minQuality = <optimized out> checkRDN = <optimized out> forbiddenChars = "\020\201\021\300\370\177\000\000\212dq\024\371\177\000\000Ф\021\300\370\177\000\000\311\000\000\000\000\000\000\000\220\323\020\300\370\177\000\000N_n\024\371\177\000\000\000\000\000\000\000\000\000\000H\201\021\300\370\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\000\000\000\000\020\201\021\300\370\177\000\000@ \032\020\300\370\177\000\000h\370\356\317\370\177\000\000D\003\357\317\370\177\000\000m\372\356\317\370\177\000\000\356a\251\024\371\177\000" nForbiddenChars = <optimized out> nQuality = <optimized out> maxConsecutivePerClass = <optimized out> nbInClass = {1, 0, -806421907, 32760, 0, 16, 1, 0, -806419728, 32760, -806421489, 32760, -1072680416, 32760, -1072680416, 32760, 346305440, 32761, -806422432, 32760, 225, 0, 5326608, 0, -806422064, 32760, 5326651, 0, -1072675392, 32760, 1630100038, 0, 334573636, 32761, 333440017, 32761, -72515583, 32761, 16281596, 0, 16281596, 0, 16281595, 0, 16281595, 0, 16281595, 0, 16281595, 0} i = <optimized out> j = <optimized out> fileConf = {{param = "\374o\370\000\000\000\000\000\020\000\000\000\060\000\000\000\060\377\356\317\370\177\000\000p\376\356\317\370\177\000", iType = typeInt, value = {iVal = 419430400, sVal = "\000\000\000\031\027\003\003\000;\000\000\000 \371\356π\000\000\000\350\375\356\317\370\177\000\000\000\000\000\000\370\177\000\000l\030\026\024\371\177\000\000\000\000\000\000\000\000\000\000P\000\000\000\000\000\000\000P9\020\300\370\177\000\000\020\020\000\300\370\177\000\000P\000\000\000\000\000\000\000\065:\361\024\371\177\000\000\377\377\377\377\370\177\000\000\340\376\356\317\370\177\000\000 \000\357\317\370\177\000\000\200t\024\024\371\177\000\000\000\000\000"}, min = 0, minForPoint = -806422080}, { param = "\370\177\000\000\360\372\356\317\370\177\000\000\246\241\344\023\371\177\000\000\300E\020\300\370\177\000\000\002\000\000", iType = typeInt, value = {iVal = -806421488, sVal = "\020\374\356\317\370\177\000\000\000\261W;z\226ӕ\000\372\356\317\370\177\000\000\000\372\356\317\370\177\000\000\060\373\356\317\370\177\000\000\373o\370\000\000\000\000\000\300E\020\300\370\177\000\000FZ)a\000\000\000\000D0\361\023\371\177\000\000P\000\000\000\000\000\000\000\020\020\000\300\370\177\000\000\203\323\020\300\370\177\000\000\220\372\356\317\370\177\000\000@\032\020\300\370\177\000\000\000\000\000\000\000\000\000\000C/\025\025\371\177\000"}, min = -806421872, minForPoint = 32760}, { param = "\203\323\020\300\370\177\000\000P\000\000\000\000\000\000\000\036(c\024\371\177\000\000\020\020\000\300\370\177\000", iType = (typeStr | unknown: 342038594), value = {iVal = 32761, sVal = "\371\177\000\000\000\000\000\000\000\000\000\030\310\"\020\300\370\177\000\000\310\"\020\300\370\177\000\000\200\066\360\317\370\177\000\000H\f\357\317\370\177\000\000\347\034c\024\371\177\000\000P\000\000\000\000\000\000\000\000\261W;z\226ӕ\230\001\357\317\370\177\000\000O&\251\024\371\177\000\000\027\000\000\000\000\000\000\000P\000\000\000\000\000\000\000\200\373\356\317\370\177\000\000@\032\020\300\370\177\000\000\350\001\357\317\370\177\000\000\300\373\356", <incomplete sequence \317>}, min = 32760, minForPoint = 23}, { param = "\000\000\000\000\001\000\000\000\000\000\000\000\200\373\356\317\370\177\000\000\241\065\251\024\371\177\000\000\001\000\000", iType = (unknown: 32760), value = {iVal = 2, sVal = "\002\000\000\000\027\000\000\000\001\000\000\000\000\000\000\000\350\"\000\300\370\177\000\000\063\000\000\000\000\000\000\000\210\373\356\317\370\177\000\000\001", '\000' <repeats 15 times>, "H\f\357\317\370\177\000\000\000\000\000\000\000\000\000\000\001\000\000\000\000\000\000\000\200\373\356\317\370\177\000\000\220\001\357\317\370\177\000\000\210\373\356\317\370\177\000\000\000\000\000\000\000\000\000\000K\000\000\000\000\000\000\000;\000\000\000\000\000\000"}, min = 353709891, minForPoint = 32761}, { param = "\000\000\000\000\000\000\000\000\200\323\020\300\370\177\000\000S\000\000\000\000\000\000\000S\000\000\000\000\000\000", iType = (unknown: 16560), value = {iVal = 0, sVal = '\000' <repeats 16 times>, "\065\070\000\000\310\"\020\300\370\177\000\000\310\"\020\300\370\177\000\000\200\066\360\317\370\177\000\000\250\r\357\317\370\177\000\000\347\034c\024\371\177\000\000\346\000\000\000\000\000\000\000\000\261W;z\226ӕ\370\002\357\317\370\177\000\000O&\251\024\371\177\000\000\027\000\000\000\000\000\000\000\346\000\000\000\000\000\000\000\340\374\356\317\370\177\000\000@\032\020\300\370\177\000\000H\003\357", <incomplete sequence \317>}, min = 32760, minForPoint = -806421216}, { param = "\370\177\000\000\027\000\000\000\000\000\000\000\001\000\000\000\000\000\000\000\340\374\356\317\370\177\000\000\241\065\251\024", iType = (typeStr | unknown: 32760), value = {iVal = 1, sVal = "\001\000\000\000\370\177\000\000@\375\356\317\027\000\000\000\001\000\000\000\000\000\000\000\270*\000\300\370\177\000\000\311\000\000\000\000\000\000\000\350\374\356\317\370\177\000\000\001", '\000' <repeats 15 times>, "\250\r\357\317\370\177\000\000\000\000\000\000\000\000\000\000\001\000\000\000\000\000\000\000\340\374\356\317\370\177\000\000\360\002\357\317\370\177\000\000\350\374\356\317\370\177\000\000\000\000\000\000\000\000\000\000\341\000\000\000\000\000\000"}, min = 209, minForPoint = 0}, { param = "\300E\020\300\370\177\000\000\000\000\000\000\000\000\000\000\200\323\020\300\370\177\000\000\351\000\000\000\000\000\000", iType = (typeStr | unknown: 232), value = {iVal = 0, sVal = "\000\000\000\000\260@", '\000' <repeats 22 times>, "\300E\020\300\370\177\000\000P\376\356\317\370\177\000\000\271\037\350\023\371\177\000\000\a\000\000\000y\000\000\000\020GQ", '\000' <repeats 13 times>, "FZ)a\000\000\000\000\340\t\022\300\370\177\000\000`\000\000\000\000\000\000\000:\000\000\000!\000\000\000\025\000\000\000\033\000\000\000\a\000\000\000y\000\000\000\005\000\000"}, min = 238, minForPoint = 0}, {param = "\370\177\000\000\000\000\000\000\000\000\000\000p_\370\000\000\000\000\000\001\000\000\000\000\000\000\000\001\000\000", iType = typeInt, value = { iVal = -1073734768, sVal = "\220\033\000\300\370\177\000\000\200\376\356\317\370\177\000\000\300~E\000\000\000\000\000\250\"\000\300\370\177\000\000u>Q\000\001\000\000\000\200\376\356\317\370\177\000\000\340J\017\001\000\000\000\000?\020\000\000\000\000\000\000\240\232\373", '\000' <repeats 14 times>, "\261W;z\226ӕ\004\000\000\000\004\000\000\000u>Q\000\000\000\000\000\001\000\000\000\000\000\000\000`\n\357\317\370\177\000\000@\022\357\317\370\177\000"}, min = 17780656, minForPoint = 0}, { param = "\003\000\000\000\000\000\000\000\020#\350\023\371\177\000\000(\000\000\000\060\000\000\000\060\377\356\317\370\177\000", iType = (unknown: 3488546416), value = {iVal = 32760, sVal = "\370\177\000\000\000\261W;z\226ӕ\020 \000\000\000\000\000\000\000\261W;z\226ӕ\345`P\000\000\000\000\000u>Q\000\000\000\000\000`\n\357\317\370\177\000\000\a\000\000\000\000\000\000\000\001\000\000\000\000\000\000\000\377\377\377\377\000\000\000\000 \022\000\300\370\177\000\000=\244E\000\000\000\000\000\240\377\356\317\370\177\000\000\001\000\000\000\000\000\000\000\001", '\000' <repeats 15 times>, "\240\377\356", <incomplete sequence \317>}, min = 32760, minForPoint = 16423072}, { param = "\000\000\000\000 \022\000\300\370\177\000\000=\244E\000\000\000\000\000@\022\357\317\370\177\000\000\001\000\000", iType = typeInt, value = {iVal = 1, sVal = "\001\000\000\000\000\000\000\000\360)\000\300\370\177\000\000@ \022\357\317\370\177\000\000\300~E\000\000\000\000\000\250\"\000\300\370\177\000\000~@Q\000\001\000\000\000@\022\357\317\370\177\000\000\340J\017\001\000\000\000\000?\020\000\000\000\000\000\000\240\230\372", '\000' <repeats 13 times>, "\002\000\000\000\000\000\000\000\005\000\000\000\005\000\000\000\377dP\000\000\000\000\000?\020\000\000\000\000\000\000\366bQ\000\000\000\000"}, min = 16453344, minForPoint = 0}, {param = "d\n\357\317\370\177", '\000' <repeats 25 times>, iType = typeInt, value = {iVal = 0, sVal = "\000\000\000\000read(=rscxd)", '\000' <repeats 12 times>, "\002", '\000' <repeats 39 times>, "\001\000\000\000\000\000\000\000\377\377\377\377\000\000\000\000\003\000\000\000\000\000\000\000\020#\350\023\371\177\000\000(\000\000\000\060\000\000\000\000\001\357\317\370\177\000\000read(=rscxd)"}, min = -1781295616, minForPoint = 0}, {param = '\000' <repeats 31 times>, iType = typeInt, value = {iVal = 0, sVal = "\000\000\000\000\000\000\000\000\001\000\000\000\000\000\000\000\377\377\377\377", '\000' <repeats 60 times>, "`w\373\000\000\000\000\000 \022\000\300\370\177\000\000=\244E\000\000\000\000\000\260\001\357\317\370\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\000\000\000"}, min = 0, minForPoint = 0}, {param = "\260\001\357\317\370\177\000\000\300~E\000\000\000\000\000\260\036\000\300\370\177\000\000\000\000\000\000\001\000\000", iType = (unknown: 3488547248), value = {iVal = 32760, sVal = "\370\177\000\000\340J\017\001\000\000\000\000?\020\000\000\000\000\000\000`w\373", '\000' <repeats 13 times>, "\002\000\000\000\000\000\000\000\004\000\000\000\004\000\000\000~@Q\000\000\000\000\000?\020\000\000\000\000\000\000\366bQ\000\000\000\000\000\000u\373\000\000\000\000\000\064\f\357\317\370\177", '\000' <repeats 34 times>, "\003\003\000"}, min = 23, minForPoint = 80}, {param = '\000' <repeats 20 times>, "\210\323\020\300\370\177\000\000\210\323\020\300", iType = (unknown: 32760), value = {iVal = 0, sVal = '\000' <repeats 127 times>}, min = 0, minForPoint = 0}, { param = '\000' <repeats 31 times>, iType = typeInt, value = {iVal = 0, sVal = '\000' <repeats 127 times>}, min = 0, minForPoint = 0}, {param = '\000' <repeats 31 times>, iType = typeInt, value = {iVal = 0, sVal = '\000' <repeats 127 times>}, min = 0, minForPoint = 0}, { param = '\000' <repeats 31 times>, iType = typeInt, value = {iVal = 0, sVal = '\000' <repeats 127 times>}, min = 0, minForPoint = 0}, {param = '\000' <repeats 31 times>, iType = typeInt, value = {iVal = 0, sVal = '\000' <repeats 127 times>}, min = 0, minForPoint = 0}, { param = '\000' <repeats 16 times>, "h\006\357\317\370\177\000\000\000\000\005\000\000\000\000", iType = (typeStr | unknown: 4294967294), value = {iVal = -1, sVal = "\377\377\377\377", '\000' <repeats 16 times>, "P\f\357\317\370\177\000\000\001\000\000\000\000\000\000\000`\f\357\317\370\177\000\000\001\000\000\000\000\000\000\000\377\377\377\377\000\000\000\000\224\246\336\023\371\177", '\000' <repeats 34 times>, ")6\361\023\371\177\000\000\000\000\000\000\000\000\000\000\220\r\357\317\370\177\000\000\000\000\000"}, min = 0, minForPoint = 0}, {param = '\000' <repeats 28 times>, "\001\000\000", iType = typeInt, value = {iVal = 0, sVal = "\000\000\000\000\000\000\000\000\240v\024\024\371\177", '\000' <repeats 26 times>, "\340\a\357\317\370\177", '\000' <repeats 22 times>, "\001\000\000\000\340\264\024\024\371\177\000\000\377\377\377\377\000\000\000\000u", '\000' <repeats 15 times>, "\200\377\377\377\377\377\377\377", '\000' <repeats 15 times>}, min = 0, minForPoint = 0}, {param = "\000\000\000\000\060\000\000\000p\016\357\317\370\177\000\000J0\361\023\371\177\000\000\001\b\357\317\370\177\000", iType = (unknown: 336997088), value = {iVal = 32761, sVal = "\371\177\000\000`\f\357\317\370\177", '\000' <repeats 42 times>, " \000\000\000\060\000\000\000p\016\357\317\370\177\000\000\260\r\357\317\370\177", '\000' <repeats 53 times>}, min = 0, minForPoint = 0}, {param = '\000' <repeats 31 times>, iType = typeInt, value = {iVal = 0, sVal = '\000' <repeats 127 times>}, min = 0, minForPoint = 0}, {param = '\000' <repeats 31 times>, iType = typeInt, value = {iVal = 0, sVal = '\000' <repeats 21 times>, "\b\357\317\370\177\000\000\000\f\357\317\370\177\000\000\000\b\357\317\370\177\000\000\000\004\000\000\000\000\000\000\060", '\000' <repeats 74 times>}, min = 0, minForPoint = 0}, {param = '\000' <repeats 31 times>, iType = typeInt, value = { iVal = 0, sVal = '\000' <repeats 120 times>, "\001\000\000\000\000\000\000"}, min = 0, minForPoint = 0}, {param = "\000\000\000\000\000\000\000\000\300E\020\300\370\177\000\000\260\016\357\317\370\177\000\000\a\000\000\000\000\000\000", iType = (unknown: 3488550592), value = { iVal = 32760, sVal = "\370\177\000\000\070\067\361\023\371\177\000\000\000p\024\024\371\177\000\000\252\266\335\023\371\177", '\000' <repeats 18 times>, "\350\005\002", '\000' <repeats 25 times>, "\371\177\000\000\220\n\357\317\370\177\000\000\377\377\377\377\377\377\377\377\000\000\000\000\000\000\000\000\001", '\000' <repeats 15 times>, "\n\000\000\000\371\177\000\000 \000\000"}, min = 0, minForPoint = -806416776}, {param = "\370\177\000\000\006\000\000\000\000\000\000\000\006", '\000' <repeats 15 times>, "X\226\340\023", iType = (typeStr | unknown: 32760), value = {iVal = 1, sVal = "\001\000\000\000\000\000\000\000\066\067\361\023\371\177\000\000\000\000\000\000\000\000\000\000\300E\020\300\370\177\000\000\220\017\357\317\370\177\000\000Y\000\000\000\000\000\000\000\260\020\357\317\370\177\000\000F\026Q\000\000\000\000\000\000p\024\024\371\177\000\000\252\266\335\023\371\177\000\000\301\357", '\000' <repeats 14 times>, "\004", '\000' <repeats 27 times>, "\377\377\377\377"}, min = -806417552, minForPoint = 32760}, {param = "\377\377\377\377\377\377\377\377\000\000\000\000\000\000\000\000\006", '\000' <repeats 11 times>, "\370\177\000", iType = (unknown: 5268038), value = {iVal = 0, sVal = '\000' <repeats 13 times>, "bP", '\000' <repeats 29 times>, "\200h\024\024\371\177\000\000h\r\000\000\000\000\000\000\020\026Q", '\000' <repeats 13 times>, "\020\026Q", '\000' <repeats 13 times>, "G\026Q", '\000' <repeats 32 times>}, min = 0, minForPoint = 0}, { param = '\000' <repeats 31 times>, iType = typeInt, value = {iVal = 0, sVal = '\000' <repeats 16 times>, "\020\000\000\000\060\000\000\000\240\021\357\317\370\177\000\000\020\000\000\000\060\000\000\000\220\021\357\317\370\177\000\000\320\020\357\317\370\177", '\000' <repeats 50 times>, "\374o\370\000\000\000\000\000\000\261W;z\226ӕ\000\000\000\000\000\000\000"}, min = -806417296, minForPoint = 32760}, {param = "3", '\000' <repeats 16 times>, "@\000\000\000\000\000\000\027\000\000\000\000\000\000", iType = (unknown: 3222280768), value = {iVal = 32760, sVal = "\370\177\000\000\066\070\251\024\371\177\000\000H\f\357\317\370\177\000\000&7\251\024\371\177\000\000\377\377\377\377\377\377\377\377\350\"\000\300\370\177\000\000H\f\357\317\370\177\000\000\001\000\000\000\000\000\000\000\000@\000\000\000\000\000\000\000\261W;z\226ӕ`\f\357\317\370\177\000\000`\f\357\317\370\177\000\000\220\r\357\317\370\177\000\000\373o\370\000\000\000\000\000\300E\020\300\370\177\000\000FZ)a\000\000\000\000D0\361\023"}, min = 32761, minForPoint = 333440017}, { param = "\371\177\000\000\001\200\255\373\370\177\000\000\374o\370\000\000\000\000\000\374o\370\000\000\000\000\000\373", <incomplete sequence \370>, iType = typeInt, value = {iVal = 16281595, sVal = "\373o\370\000\000\000\000\000\373o\370\000\000\000\000\000\373o\370\000\000\000\000\000\373o\370\000\000\000\000\000\374o\370", '\000' <repeats 49 times>, "\200", '\000' <repeats 13 times>, "\370\000\200", '\000' <repeats 13 times>, "\357\317\370\177\000\000\000\000\000\000\000\000\000"}, min = -1, minForPoint = -1}, {param = "\000\000\000\000\000\000\000\000\377\377\377\377\065\070\377\377\000\261W;z\226ӕ\377\377\377\377\000\000\000", iType = (typeStr | unknown: 333505162), value = {iVal = 32761, sVal = "\371\177\000\000\354\t\022\300\370\177\000\000\200t\024\024\371\177\000\000\000\000\000\000\000\000\000\000\017\000\000\000\001\000\000\000\354\t\022\300\370\177\000\000\246\241\344\023\371\177\000\000\202\r132584\002\000\000\000\000\000\000\000\320\017\357\317\370\177\000\000`|\024\024\371\177\000\000\207\017\357\317\370\177\000\000p_\370\000\000\000\000\000\356\037\000\000\000\000\000\000p\016\357\317\370\177\000\000\260\r\357\317\t\000\000\000\002\000\000"}, min = -1781295494, minForPoint = 51}, { param = "\000\000\000\000\060\016\357\317\370\177\000\000\216\016\357\317\370\177\000\000\224\016\357\317\370\177\000\000\220\016\357", <incomplete sequence \317>, iType = (unknown: 32760), value = {iVal = -806416748, --Type <RET> for more, q to quit, c to continue without paging--c sVal = "\224\016\357\317\370\177\000\000\000\000\000\000\000\000\000\000`\000\000\000\000\000\000\000\020 \000\000\000\000\000\000\000\261W;z\226ӕ\240\071\020\300\370\177\000\000\320\071\020\300\370\177\000\000\063\000\000\000\000\000\000\000\350\"\000\300\370\177\000\000\200\020\357\317\065\070\000\000\000\261W;z\226ӕ\000\000\000\000\000\000\000\000\213\342\340\023\371\177\000\000\354\t\022\300\370\177\000\000\373\037\000\000\000\000\000\000@\231\024\024\371\177\000"}, min = 15, minForPoint = 1}, {param = "\354\t\022\300\370\177\000\000\252\237\344\023\371\177\000\000\222\016\061\063\062\065\070\064\000\261W;z\226ӕ", iType = (unknown: 3488550864), value = {iVal = 32760, sVal = "\370\177\000\000\020 \000\000\000\000\000\000\320\t\022\300\370\177\000\000\220\000\000\000\000\000\000\000 \000\000\300\370\177\000\000\340)\022\300\370\177\000\000\004\000\000\000\000\000\000\000\177\004\341\023\371\177\000\000\030\000\000\000\060\000\000\000\240\017\357\317\370\177\000\000\340\016\357\317\370\177\000\000\340\t\022\300\370\177\000\000\177\000\000\000\000\000\000\000\320\t\022\300\370\177\000\000\000\000\000\000\000\000\000\000\220\000\000\000\000\000\000\000\020 \000"}, min = 0, minForPoint = 333518475}, {param = "\371\177\000\000FZ)a\000\000\000\000\213\342\340\023\371\177\000\000\005\000\000\000\000\000\000\000\300E\020\300", iType = (unknown: 32760), value = {iVal = -806416448, sVal = "\300\017\357\317\370\177\000\000\000\261W;", '\000' <repeats 12 times>, "\300E\020\300\370\177", '\000' <repeats 11 times>, "\261W;z\226ӕ\000\000\000\000\000\000\000\000\001\000\000\000\000\000\000\000\377\377\377\377\000\000\000\000\025", '\000' <repeats 15 times>, "\300E\020\300\370\177\000\000\260\020\357\317\370\177\000\000\271\037\350\023\371\177\000\000\340\021\357\317\370\177\000\000\020\026Q\000\000\000\000"}, min = -806415904, minForPoint = 32760}, {param = "FZ)a\000\000\000\000\340\t\022\300\370\177\000\000~\000\000\000\000\000\000\000:\000\000\000!\000\000", iType = (typeStr | unknown: 20), value = {iVal = 27, sVal = "\033\000\000\000\a\000\000\000y\000\000\000\005\000\000\000\356", '\000' <repeats 19 times>, "p_\370\000\000\000\000\000\020\000\000\000\370\177\000\000\000\000\357\317\370\177\000\000\000\000\000\000\000\000\000\000\001\000\000\000\000\000\000\000\001\000\000\000\000\000\000\000\377\377\377\377\377\377\377\377\000\000\000\000\000\000\000\000\320\"\000\300\370\177\000\000 \022\000\300\370\177\000\000\377\377\377\377\370\177\000\000\340)\360", <incomplete sequence \317>}, min = 32760, minForPoint = -1073737184}, {param = "\370\177\000\000\000\261W;z\226ӕ\000\000\000\000\000\000\000\000\340)\360\317\370\177\000\000\340)\360", <incomplete sequence \317>, iType = (unknown: 32760), value = {iVal = 0, sVal = "\000\000\000\000\000\000\000\000 \022\000\300\370\177\000\000\000\000\000\000\000\000\000\000 \022\000\300\370\177\000\000\020#\350\023\371\177\000\000\060\000\000\000\060\000\000\000\240\021\357\317\370\177\000\000\320\020\357\317\370\177\000\000\000\261W;z\226ӕ\340\020\357\317\370\177\000\000\000\261W;z\226ӕ\350\023\000\300\370\177\000\000e", '\000' <repeats 15 times>, "\340\021\357\317\370\177\000\000\000\000\000\000\000\000\000"}, min = 61377, minForPoint = 0}, {param = "\334\017\000\000\000\000\000\000\260\377\377\377\377\377\377\377", '\000' <repeats 15 times>, iType = (unknown: 3221230112), value = {iVal = 32760, sVal = "\370\177\000\000\202\f\341\023\371\177\000\000\220\022\357\317\370\177\000\000\320\021\357\317\370\177\000\000\000\000\000\000\000\000\000\000 \022\000\300\370\177\000\000\220\021\357\317\370\177\000\000|\310x@\375\177\000\000\067N\361\024\371\177\000\000\000\000\000\000\000\000\000\000\340)\360\317\370\177\000\000\065[D\000\000\000\000\000\004\000\000\000\000\000\000\000FbP\000\000\000\000\000\000\022\357\317\370\177\000\000\000\000\000\000\000\000\000\000\377\377\377\377"}, min = -1, minForPoint = 32445072}, {param = "\000\000\000\000\240R\361\024\371\177\000\000\213\342\340\023\371\177\000\000\000\000\000\000\000\000\000\000\301\357\000", iType = typeInt, value = {iVal = 1835627633, sVal = "qtime=0.0000\000\000\000\000time=0.061377\000\000\000\340)\360\317\370\177\000\000\000\261W;z\226ӕp\022\357\317\370\177\000\000\220\022\357\317\370\177\000\000\340)\360\317\370\177\000\000\000\000\000\000\000\000\000\000`\025\021\300\370\177\000\000\000\026\357\317\370\177\000\000 \022\000\300\370\177\000\000|\025\361\024\371\177\000\000 \022\000\300\370\177\000\000;\327K\000\000\000\000"}, min = 1, minForPoint = 0}, {param = "\000\000\000\000\000\000\000\000\250\"\000\300\370\177", '\000' <repeats 17 times>, iType = (unknown: 5268038), value = {iVal = 0, sVal = "\000\000\000\000\000\000\001\000\000\000\000\000\377\377\377\377\377\377\377\377", '\000' <repeats 24 times>, "\067P\020\300\370\177\000\000\f`\020\300\370\177", '\000' <repeats 26 times>, " \022\000\300\370\177\000\000\000\026\357\317\370\177\000\000 \022\000\300\370\177\000\000\066-E\000\000\000\000\000\b\000\000\000\000\000\000\000\360S", <incomplete sequence \320>}, min = 32760, minForPoint = -806415576}, {param = "\370\177\000\000\000\000\000\000\000\000\000\000p\025\357\317\370\177\000\000\260\025\357\317\370\177\000\000`\025\021\300", iType = (unknown: 32760), value = {iVal = -806414848, sVal = "\000\026\357\317\370\177\000\000 \022\000\300\370\177\000\000\031\371J\000\000\000\000\000V\000\000\000\000\000\000\000\062\000\000\000\001\000\000\000\242\211q\320\370\177\000\000\260\036\000\300\370\177\000\000 \022\000\300\370\177\000\000\260\025\357\317\370\177\000\000`\025\021\300\370\177\000\000\335jM\000\000\000\000\000`\025\021\300\370\177\000\000\340)\360\317\370\177\000\000\340)\360\317\370\177\000\000/\333K", '\000' <repeats 12 times>}, min = -836759528, minForPoint = 32760}, {param = "\020 @\317\370\177\000\000\377\377\377\377\377\377\377\377\030\020 \316\370\177\000\000\000\000\000\000\000\000\000", iType = (unknown: 3459256344), value = {iVal = 32760, sVal = "\370\177\000\000\004\000\000\000\000\000\000\000\220*\000\300\370\177\000\000\000\000\000\000\000\000\000\000 \022\000\300\370\177\000\000FZ)a\000\000\000\000\000\000\000\000\020\016\000\000\000\000\000\000\000\000\000\000\340)\360\317\370\177\000\000\000\026\357\317\370\177", '\000' <repeats 53 times>}, min = 4, minForPoint = 4}, {param = "\000\000\000\000c", '\000' <repeats 15 times>, "\260\036\000\300\370\177\000\000\000\000\000", iType = typeInt, value = {iVal = 4159, sVal = "?\020\000\000\000\000\000\000\220\066\021\300\370\177\000\000\340.\021\300\370\177\000\000\260\025\357\317\370\177", '\000' <repeats 34 times>, "\243\000\000\000\000\000\000\000P\025\357\317\370\177\000\000\030\034\000\300\370\177\000\000\000\000\000\000\000\000\000\000\241\000\000\000\000\000\000\000\320\024\357\317\370\177", '\000' <repeats 17 times>}, min = 0, minForPoint = 0}, {param = '\000' <repeats 31 times>, iType = typeInt, value = {iVal = 0, sVal = '\000' <repeats 20 times>, "\005\000\000\000\000\000\000\000\b\000\000\000\000\000\000\000\334\312R", '\000' <repeats 13 times>, "x\004\000\000\000\000\000\000\200\063{\320\370\177", '\000' <repeats 18 times>, "\034\000\000\000\000\000\000\000\210\036\000\300\370\177", '\000' <repeats 26 times>, "P\035\003\001"}, min = 0, minForPoint = -1072622240}, {param = "\370\177\000\000\001\000\000\000\001\000\000\000X\036\000\300\370\177", '\000' <repeats 13 times>, iType = typeInt, value = {iVal = 0, sVal = "\000\000\000\000\000\000\000\000\220\321K", '\000' <repeats 21 times>, "\200\"\000\300\370\177", '\000' <repeats 34 times>, "`\025\021\300\370\177", '\000' <repeats 38 times>, "\004\000\000\000`\025\021\300\370\177\000"}, min = -1072615712, minForPoint = 32760}, {param = "c\000\000\000\000\000\000\000\020 @\317\370\177\000\000\030\020\070\316\370\177\000\000\002\000\000\000\001\000\000", iType = (unknown: 2), value = {iVal = 0, sVal = "\000\000\000\000\023\000\000\000\000\000\000\000\030\211q\320\370\177\000\000\023\000\000\000\000\000\000\000\270\211q\320\370\177", '\000' <repeats 93 times>}, min = 0, minForPoint = 0}, {param = '\000' <repeats 31 times>, iType = typeInt, value = {iVal = 0, sVal = '\000' <repeats 127 times>}, min = 0, minForPoint = 0}, {param = '\000' <repeats 31 times>, iType = typeInt, value = {iVal = 0, sVal = '\000' <repeats 127 times>}, min = 0, minForPoint = 0}, {param = '\000' <repeats 31 times>, iType = typeInt, value = {iVal = 0, sVal = '\000' <repeats 127 times>}, min = 0, minForPoint = 0}, {param = '\000' <repeats 31 times>, iType = typeInt, value = {iVal = 0, sVal = '\000' <repeats 127 times>}, min = 0, minForPoint = 0}, {param = '\000' <repeats 31 times>, iType = typeInt, value = {iVal = 0, sVal = '\000' <repeats 127 times>}, min = 0, minForPoint = 0}} #1 0x00000000004e6691 in ?? () No symbol table info available. #2 0x00000000004e8490 in ?? () No symbol table info available. #3 0x000000000049e912 in overlay_op_walk () No symbol table info available. #4 0x000000000049ea8b in ?? () No symbol table info available. #5 0x0000000000466112 in passwd_extop () No symbol table info available. #6 0x0000000000464996 in fe_extended () No symbol table info available. #7 0x0000000000464672 in do_extended () No symbol table info available. #8 0x0000000000435813 in ?? () No symbol table info available. #9 0x00000000004362eb in ?? () No symbol table info available. #10 0x00007ff91515afce in ldap_int_thread_pool_wrapper (xpool=0xfbcc00) at tpool.c:1053 pq = 0xfbcc00 pool = 0xfbcb00 task = 0x7ff8c8000eb0 work_list = <optimized out> ctx = {ltu_pq = 0xfbcc00, ltu_id = 140706617243392, ltu_key = {{ltk_key = 0x4338e0, ltk_data = 0x7ff8c00016a0, ltk_free = 0x4339a0}, {ltk_key = 0x485b00 <slap_sl_mem_init>, ltk_data = 0x7ff8c0001090, ltk_free = 0x4859c0 <slap_sl_mem_destroy>}, {ltk_key = 0x448200 <slap_op_free>, ltk_data = 0x0, ltk_free = 0x4481c0}, {ltk_key = 0x1205800, ltk_data = 0x7ff8c0111560, ltk_free = 0x4d5c80}, {ltk_key = 0x4bd260, ltk_data = 0x7ff8ce201010, ltk_free = 0x4bd370}, {ltk_key = 0x4bd1b0, ltk_data = 0x7ff8cf402010, ltk_free = 0x4bd230}, {ltk_key = 0x0, ltk_data = 0x0, ltk_free = 0x0} <repeats 26 times>}} kctx = <optimized out> i = <optimized out> keyslot = <optimized out> hash = <optimized out> pool_lock = 0 freeme = 0 __PRETTY_FUNCTION__ = "ldap_int_thread_pool_wrapper" #11 0x00007ff91415815a in start_thread (arg=<optimized out>) at pthread_create.c:479 ret = <optimized out> pd = <optimized out> unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140706617243392, 3733113568574194545, 140706625625230, 140706625625231, 140706625625360, 140706617241536, -3729208213329001615, -3729957785484639375}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = <optimized out> #12 0x00007ff913e87dd3 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 No locals. Thread 2 (Thread 0x7ff8d0704700 (LWP 132586)): #0 0x00007ff913e88107 in epoll_wait (epfd=6, events=0xf8a270, maxevents=1024, timeout=42960000) at ../sysdeps/unix/sysv/linux/epoll_wait.c:30 resultvar = 18446744073709551612 sc_cancel_oldtype = 0 sc_ret = <optimized out> #1 0x000000000043083c in ?? () No symbol table info available. #2 0x00007ff91415815a in start_thread (arg=<optimized out>) at pthread_create.c:479 ret = <optimized out> pd = <optimized out> unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140706625636096, 3733113568574194545, 140725685024126, 140725685024127, 140725685024256, 140706625634240, -3729244496675847311, -3729957785484639375}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = <optimized out> #3 0x00007ff913e87dd3 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 No locals. Thread 1 (Thread 0x7ff91558c740 (LWP 132584)): #0 0x00007ff91415964d in __GI___pthread_timedjoin_ex (threadid=140706625636096, thread_return=0x0, abstime=0x0, block=<optimized out>) at pthread_join_common.c:89 __tid = 132586 _buffer = {__routine = 0x7ff9141594a0 <cleanup>, __arg = 0x7ff8d0704d28, __canceltype = 0, __prev = 0x0} oldtype = 0 pd = 0x7ff8d0704700 self = <optimized out> result = 0 #1 0x0000000000432fea in slapd_daemon () No symbol table info available. #2 0x0000000000418ea9 in main () No symbol table info available. --- Regards, Kevin Martin On Fri, Aug 27, 2021 at 1:00 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Friday, August 27, 2021 7:51 PM +0100 Howard Chu <hyc(a)symas.com> > wrote: > > > kevin martin wrote: > >> I'll try that. I have narrowed it down to the ppm.so from > >> slapd-modules/ppm. I removed ppm.so from /usr/local/libexec/openldap, > >> restarted slapd, ran the command that killed it prior and it didn't die, > >> stopped slapd, recompiled ppm and installed the new ppm.so in > >> libexec/openldap, restarted slapd and reran the password change and > >> boom, down went Frazier! > > > > If this module was built for and working with OpenLDAP 2.4, then it needs > > to be modified to work with 2.5. If you compiled it against a 2.5 source > > tree, without any other modifications, you should have gotten a compile > > error. > > > It didn't exist in the contrib directory in OpenLDAP 2.4, and he > specifically noted he built it out of contrib with 2.5. > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

3 2

Re: 2.5.7 - adding memberof module Duplicate attributeType
by Dave Macias 28 Aug '21

28 Aug '21

Im attempting to move from rfc2307 to rfc2307bis Ive had no issue doing this. I scripted it :) Before, when i did not add the memberof module/overlay, i attempted to do an ldapsearch uid=bla memberof but would return nothing. So i thought i missed something… So i was going to add the module and then the overlay. But looks like im misunderstanding something altogether by your response… :) Maybe my ldapsearch was wrong to begin with… What could i be missing? On Aug 27, 2021, 5:47 PM -0400, Quanah Gibson-Mount <quanah(a)symas.com>, wrote: > > > --On Friday, August 27, 2021 6:09 PM -0400 Dave Macias <davama(a)gmail.com> > wrote: > > > > > Hello again... > > > > On a clean rocky linux install i cannot seem to be able to add the > > memberof.la module. Get below output: > > First question is, why are you installing memberOf module at all? :) > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com>

2 2

2.5.7 - adding memberof module Duplicate attributeType
by Dave Macias 27 Aug '21

27 Aug '21

Hello again... On a clean rocky linux install i cannot seem to be able to add the memberof.la module. Get below output: 61295355.3b7373e7 0x7ff631852940 @(#) $OpenLDAP: slapd 2.5.7 (Aug 19 2021 17:48:53) $ mockbuild@3b6af787015541c89363999d4338d587 :/builddir/build/BUILD/openldap-2.5.7/servers/slapd 61295356.01d90296 0x7ff631852940 config error processing cn={4}msuser,cn=schema,cn=config: olcAttributeTypes: Duplicate attributeType: "P�e�;V" 61295356.0203a145 0x7ff631852940 slapd stopped. 61295356.0204a690 0x7ff631852940 connections_destroy: nothing to destroy. Here are all my steps I do: wget -q https://repo.symas.com/configs/SOLDAP/rhel8/release25.repo -O /etc/yum.repos.d/soldap-release25.repo dnf install -y symas-openldap-clients symas-openldap-servers # enable default configs cd /opt/symas/etc/openldap/ cp ldap.conf.default ldap.conf cp slapd.conf.default slapd.conf cp slapd.ldif.default slapd.ldif # use secret as cn=config password sed -i 's/^# rootpw/rootpw/g' slapd.conf # make some dirs mkdir /opt/symas/etc/openldap/slapd.d mkdir /var/log/slapd/ # enable/start systemctl enable --now slapd source /etc/profile.d/50-soldap.sh # the slapd.d dir will be empty so create the slapd-conf structure slaptest -f /opt/symas/etc/openldap/slapd.conf -F /opt/symas/etc/openldap/slapd.d systemctl restart slapd cd # change the cn=config secret cat >config-secret.ldif <<EOF dn: olcDatabase={0}config,cn=config changetype: modify replace: olcRootPW olcRootPW: {SSHA}blablabalblabla/ EOF ldapadd -D cn=config -w secret -H ldapi:/// -f config-secret.ldif # add a few schemas # had to remove tha last 7 lines tac /opt/symas/etc/openldap/schema/rfc2307bis.ldif | sed '1,7 d' | tac > /opt/symas/etc/openldap/schema/rfc2307bis-new.ldif for def in cosine.ldif rfc2307bis-new.ldif inetorgperson.ldif msuser.ldif; do ldapadd -D cn=config -w $config_pass -H ldapi:/// -f /opt/symas/etc/openldap/schema/$def done # add memberof module cat >memberof-module.ldif <<EOF dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulePath: /opt/symas/lib/openldap/ olcModuleLoad: memberof.la EOF ldapadd -D cn=config -w $config_pass -H ldapi:/// -f memberof-module.ldif systemctl restart slapd at this point i get the error from above.... I've looked around to see where the "Duplicate attribute" is... but cannot find it.. Any input is much appreciated! Thank you very much for the awesome support!!!! -Dave

2 1

Symas OpenLDAP Handbook: Operator and Administrator Guide with Training Labs Book
by Dr. Ogg 27 Aug '21

27 Aug '21

Does anyone know when the Symas OpenLDAP Handbook: Operator and Administrator Guide with Training Labs Book be be realized on kindle? Or other ebook option? Thanks https://www.amazon.com/Symas-OpenLDAP-Handbook-Operator-Administrator/dp/B0… <https://www.amazon.com/Symas-OpenLDAP-Handbook-Operator-Administrator/dp/B0…>

1 0

Re: OpenLDAP 2.5.7 dies
by kevin martin 27 Aug '21

27 Aug '21

I'll try that. I have narrowed it down to the ppm.so from slapd-modules/ppm. I removed ppm.so from /usr/local/libexec/openldap, restarted slapd, ran the command that killed it prior and it didn't die, stopped slapd, recompiled ppm and installed the new ppm.so in libexec/openldap, restarted slapd and reran the password change and boom, down went Frazier! --- Regards, Kevin Martin On Fri, Aug 27, 2021 at 11:30 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Friday, August 27, 2021 11:44 AM -0500 kevin martin <ktmdms(a)gmail.com> > > wrote: > > > > > > > 41720 sendto(3, "<165>Aug 27 15:36:40 slapd[41718]: ppm: entry > > uid=kmart,ou=people,dc=lecpq,dc=com", 87, MSG_NOSIGNAL, NULL, 0) = 87 > > 41720 getpid() = 41718 > > 41720 sendto(3, "<165>Aug 27 15:36:40 slapd[41718]: ppm: Reading > > pwdCheckModuleArg attribute", 75, MSG_NOSIGNAL, NULL, 0) = 75 > > 41720 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x8} > --- > > 41718 <... futex resumed>) = ? > > 41720 +++ killed by SIGSEGV +++ > > 41719 <... epoll_wait resumed> <unfinished ...>) = ? > > 41719 +++ killed by SIGSEGV +++ > > 41718 +++ killed by SIGSEGV +++ > > > > > > > > > > still now coredump file. I'll try changing the kernel.core_pattern and > > see if we get something somewhere. > > > Coredumps are often useless because they lose key information. You want > to > get a trace under gdb while the process is executing. > > Start slapd > > gdb /path/to/slapd PID > (gdb) cont > > execute the command that crashes slapd > > at the gdb prompt: > > gdb thr apply all bt full > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

3 4

openSUSE/SLE users, migrate to back-mdb now!
by Michael Ströder 27 Aug '21

27 Aug '21

HI! This is an important note to those who run OpenLDAP slapd based on openSUSE or SLE packages, especially Tumbleweed: If you're still using OpenLDAP 2.4 or earlier with back-bdb or back-hdb then migrate to back-mdb now because OpenLDAP 2.5 packages won't support these backends anymore! Disclaimer: I'm writing as a package maintainer who only updates package "openldap2" in openSUSE Factory/Tumbleweed. I have no official role in openSUSE project nor SUSE. Background: As you might already know OpenLDAP 2.5 builds by default have no more support for backends back-hdb and back-bdb based on Berkeley-DB. Furthermore using Berkeley-DB in general is deprecated. I've received a request to update the openSUSE package "openldap2" and its sub-packages to OpenLDAP release 2.5.7 also removing back-bdb and back-hdb [1]. I'd love to accept this update request really soon because I also want to have the new features in libldap. So the update will hit openSUSE Tumbleweed really soon. While this change will *not* affect your deployments based on packages from SLE or openSUSE Leap 15.3 or earlier you should prepare your installation for possible future updates by migrating to back-mdb now. And always use slapcat to backup your database(s) and practice restoring your databases to be prepared for any desaster. Ciao, Michael. [1] https://build.opensuse.org/request/show/914040

3 5

How to determine olcDbMaxSize
by Dave Macias 27 Aug '21

27 Aug '21

Hello, Playing around with moving from 2.4.59 hdb to 2.5.7 mdb. According to the admin page, one of the changes is adding olcDbMaxSize. Noticed that the default on 2.5.7 is: (1GB) olcDbMaxSize: 1073741824 My db does not come close to that but was curious how one can determine what the db size is currently ? Do you ls -h the /var/symas/openldap-data/data.mdb file ? Thank you, Dave

3 2

OpenLDAP 2.5.7 dies
by kevin martin 27 Aug '21

27 Aug '21

Aug 27 14:25:38 newldap0.mgt.ch3.bmi slapd[38335]: ppm: Reading pwdCheckModuleArg attribute Aug 27 14:25:38 newldap0.mgt.ch3.bmi systemd[1]: slapd.service: Main process exited, code=killed, status=11/SEGV Aug 27 14:25:38 newldap0.mgt.ch3.bmi systemd[1]: slapd.service: Failed with result 'signal'. is this a known issue? Oracle Linux 8. what can I do to help determine what occurred? --- Regards, Kevin Martin

3 9

OT: Net:LDAPapi / LDAPS-Support?
by A. Schulze 26 Aug '21

26 Aug '21

Hello, I took over a service using the Perl NET::LDAPapi. Now I fail to establish an LDAPS connection. Does anybody know if that's even supported and if so, how I've to setup that? Andreas

3 4

Re: /usr/local/etc/openldap/slapd.conf: line 39: <password-hash> scheme not available ({SHA512})
by kevin martin 26 Aug '21

26 Aug '21

ah, yes, I see. I made a bad assumption that, when doing a "make" in the password module, that it would make everything there and under it, including subdirectories. going into sha2 under password and doing a make works fine. my bad. --- Regards, Kevin Martin On Thu, Aug 26, 2021 at 11:41 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Thursday, August 26, 2021 12:38 PM -0500 kevin martin > <ktmdms(a)gmail.com> wrote: > > > > > > > so I sb able to take the pw-sha2 module that I compiled for RHEL7 and > > simply move it over to RHEL8? Ugh, so ugly that we can't remake the > > module on RHEL8 (is it unsupported?) due to missing dependencies... > > The pw-sha2 module has no dependencies on any radius libraries. > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Re: 2.5.7 for RHEL8 - Question
by Dave Macias 26 Aug '21

26 Aug '21

Thank you! On Wed, Aug 25, 2021 at 3:08 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Wednesday, August 25, 2021 3:57 PM -0400 Dave Macias > <davama(a)gmail.com> wrote: > > > > > Awesome! > > > > So then, if it's already shipped, why dont I see the schema files for > > ppolicy? > > Would have thought to find it here: /opt/symas/etc/openldap/schema > > I strongly advise reading the OpenLDAP 2.5 admin guide section on > upgrading, specifically: > > < > https://www.openldap.org/doc/admin25/appendix-upgrading.html#ppolicy%20over… > > > > which directly answers your question. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

4 6

Re: /usr/local/etc/openldap/slapd.conf: line 39: <password-hash> scheme not available ({SHA512})
by kevin martin 26 Aug '21

26 Aug '21

so I sb able to take the pw-sha2 module that I compiled for RHEL7 and simply move it over to RHEL8? Ugh, so ugly that we can't remake the module on RHEL8 (is it unsupported?) due to missing dependencies... --- Regards, Kevin Martin On Thu, Aug 26, 2021 at 11:35 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Thursday, August 26, 2021 12:32 PM -0500 kevin martin > <ktmdms(a)gmail.com> wrote: > > > > > > > pw-ssha? I had a pw-sha2 module loaded but not pw-ssha. and the > > password module won't compile at this time because there's no > > radius-devel package for RHEL 8 that I can find in any repos. > > Sorry, pw-sha2 module. ;) > > If you have it instantiated and things aren't working, it would appear > it's > not actually loading as desired. But it's worked fine for me with > existing > 2.4 -> 2.5 configuration migrations, so this would be something different > on your end. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 2

Re: /usr/local/etc/openldap/slapd.conf: line 39: <password-hash> scheme not available ({SHA512})
by kevin martin 26 Aug '21

26 Aug '21

pw-ssha? I had a pw-sha2 module loaded but not pw-ssha. and the password module won't compile at this time because there's no radius-devel package for RHEL 8 that I can find in any repos. --- Regards, Kevin Martin On Thu, Aug 26, 2021 at 11:09 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Thursday, August 26, 2021 11:55 AM -0500 kevin martin > <ktmdms(a)gmail.com> wrote: > > > > > > > while trying to convert from a slapd.conf file to a cn=config style, > > slaptest displays the error as shown in the subject line. openldap 2.4 > > supported "password-hash {SHA512}" in the slapd.conf, is this simply an > > issue of password-hash not being able to be converted or is that > > *particular* password-hash line unsupported in the latest 2.5 (building > > from source)? > > It has always required that the pw-ssha contrib module exist and be loaded > in the configuration. 2.5 is no different than 2.4 in this. > > Regards, > Quanah > > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

/usr/local/etc/openldap/slapd.conf: line 39: <password-hash> scheme not available ({SHA512})
by kevin martin 26 Aug '21

26 Aug '21

while trying to convert from a slapd.conf file to a cn=config style, slaptest displays the error as shown in the subject line. openldap 2.4 supported "password-hash {SHA512}" in the slapd.conf, is this simply an issue of password-hash not being able to be converted or is that *particular* password-hash line unsupported in the latest 2.5 (building from source)? --- Regards, Kevin Martin

2 1

Re: 2.5.7 for RHEL8 - Question
by Dave Macias 25 Aug '21

25 Aug '21

Awesome! So then, if it's already shipped, why dont I see the schema files for ppolicy? Would have thought to find it here: /opt/symas/etc/openldap/schema > find /opt/ -name *ppolicy* /opt/symas/lib/openldap/ppolicy.la /opt/symas/lib/openldap/ppolicy.so /opt/symas/lib/openldap/ppolicy-2.5.so.0 /opt/symas/lib/openldap/ppolicy-2.5.so.0.1.2 /opt/symas/share/man/man5/slapo-ppolicy.5 Thank you again for the quick responses! On Wed, Aug 25, 2021 at 2:07 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Wednesday, August 25, 2021 2:33 PM -0400 Dave Macias > <davama(a)gmail.com> wrote: > > > > > Thank you Quanah for the response! > > Makes sense. > > > > One more question: > > under: /opt/symas/etc/openldap/schema/README > > It says that ppolicy is > > ppolicy.schema Password Policy Schema (work in progress) > > > > > > > > If i'm not mistaken, this would be the new ppolicy10 , yes? > > > https://datatracker.ietf.org/doc/html/draft-behera-ldap-password-policy-10 > > Actually that should be deleted from the README, thanks. But yes, the > ppolicy shipped with OpenLDAP 2.5 is based on draft 10, as documented in > the man page. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Re: 2.5.7 for RHEL8 - Question
by Dave Macias 25 Aug '21

25 Aug '21

Thank you Quanah for the response! Makes sense. One more question: under: /opt/symas/etc/openldap/schema/README It says that ppolicy is ppolicy.schema Password Policy Schema (work in progress) If i'm not mistaken, this would be the new ppolicy10 , yes? https://datatracker.ietf.org/doc/html/draft-behera-ldap-password-policy-10 Thanks! On Wed, Aug 25, 2021 at 1:27 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Wednesday, August 25, 2021 2:17 PM -0400 Dave Macias > <davama(a)gmail.com> wrote: > > > Without doing any configuration, I attempted to start the slapd > > but /opt/symas/etc/openldap/slapd.conf did not exist, since it > > was /opt/symas/etc/openldap/slapd.conf.default . Which was an easy name > > change. After that the slapd service started without issues. > > > > My question is, why are the pkg files now under /opt? > > Two reasons: > > a) It preserves the installation paths of the Symas OpenLDAP Gold product > b) Installation paths are identical regardless of host OS. While RHEL8 > has > dropped OpenLDAP server support, other OSes have not. Additionally, > RedHat > has not stopped shipping the 2.4 libldap, so we still need isolation at > that level. > > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

2.5.7 for RHEL8 - Question
by Dave Macias 25 Aug '21

25 Aug '21

Hello, I am very excited about testing this new 2.5.X version. Thank you for the release! Just testing out the prepackaged versions on a clean rocky linux install Specifically: https://repo.symas.com/soldap/rhel8/ Without doing any configuration, I attempted to start the slapd but /opt/symas/etc/openldap/slapd.conf did not exist, since it was /opt/symas/etc/openldap/slapd.conf.default . Which was an easy name change. After that the slapd service started without issues. My question is, why are the pkg files now under /opt? Before, at least in the symas-openldap pkg for 2.4.X they were installed under /etc/, /var/lib/, /usr/bin, etc. I'm assuming this was because it was meant to replace the RedHat openldap pkg.. yes? But now there is no RedHad openldap pkg for rhel8 so there is nothing to replace... Thank you, Dave

2 1

Re: OpenLDAP 2.5.5 PPA for Ubuntu 20.04 LTS
by Saša-Stjepan Bakša 24 Aug '21

24 Aug '21

On Tue, 24 Aug 2021 at 19:39, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > We don't provide any i386 data, which is what that message is saying. > I.e., your local apt command looked for an i386 architecture and was > unable > to find one. For some reason, Ubuntu still configures to look for i386 by > default. > I see it now. *root@ldap-proxy:/etc/apt# dpkg --print-foreign-architecturesi386* Well, if they did it on purpose I will not change it but I am still puzzled. > Documentation error, thank you. I'll fix that right away. :) > > You are welcome! Br Saša

1 0

Re: OpenLDAP 2.5.5 PPA for Ubuntu 20.04 LTS
by Dave Macias 24 Aug '21

24 Aug '21

> It's our replacement for Symas OpenLDAP for Linux and Symas OpenLDAP for > Gold. They are free to use and optional support contracts are available. > We're currently working on an official announcement to post, but thought > I'd point you at them since they're ready from the technical perspective. > > --Quanah > Was about to ask if they were still considered WIP... Thank you again for the support!! -Dave

1 0

Re: OpenLDAP 2.5.5 PPA for Ubuntu 20.04 LTS
by Saša-Stjepan Bakša 24 Aug '21

24 Aug '21

Hi Quanah, Long time has passed since our last conversation. :-) Thank you for your info. I was looking around your site and didn't find this repo. Are those commercial release packages or public? Br Saša On Mon, 23 Aug 2021 at 18:12, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Monday, August 23, 2021 3:15 PM +0200 Saša-Stjepan Bakša > <ssbaksa(a)gmail.com> wrote: > > > > Does anyone maintain PPA for OpenLDAP 2.5.5 PPA for Ubuntu 20.04 LTS? > > On the Symas page, there is a package only for 2.4.59+dfsg-1ppa~bionic1 > > and since Quanah recommends the latest version for using dynlist I am in > > a bit of a problem. I just can't find the proper deb package for Ubuntu. > > Hi Saša-Stjepan Bakša, > > Symas OpenLDAP 2.5 can be obtained from: > > <https://repo.symas.com/soldap/ubuntu20/> > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

OpenLDAP 2.5.5 PPA for Ubuntu 20.04 LTS
by Saša-Stjepan Bakša 24 Aug '21

24 Aug '21

Hi, Does anyone maintain PPA for OpenLDAP 2.5.5 PPA for Ubuntu 20.04 LTS? On the Symas page, there is a package only for 2.4.59+dfsg-1ppa~bionic1 and since Quanah recommends the latest version for using dynlist I am in a bit of a problem. I just can't find the proper deb package for Ubuntu. Well to be honest, there is one for the latest Ubuntu but that one is still under development and I can't use that in production. Switching to another distro? Well, after so many years using Ubuntu I am not fond of the idea of switching to another distro. Building it from scratch? Maybe, if I can create an Ubuntu building environment. Br, Saša-Stjepan Bakša

3 3

Re: migrate from 2.4 to 2.5, determine existing MDB format
by kevin martin 20 Aug '21

20 Aug '21

i understand that ldap is a protocol but it occurred to me that a database change (where tables and the like might be different and slapd version dependent) might need to be a sitewide thing, not a server by server thing (meaning the 2.4 servers, once the "database" is mirrored from the master server, might not understand the new format?). --- Regards, Kevin Martin On Thu, Aug 19, 2021 at 12:31 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Thursday, August 19, 2021 1:23 PM -0500 kevin martin > <ktmdms(a)gmail.com> wrote: > > > > > > > if I have multiple slapd servers running 2.4 can I update my master > > server to 2.5 with the new format and will the 2.4 mirrors be able to > > handle the new format or is it an all or nothing upgrade of all servers > > at once? > > LDAP is a protocol, the internal change to the MDB database structure is > immaterial. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

3 3

Re: migrate from 2.4 to 2.5, determine existing MDB format
by kevin martin 19 Aug '21

19 Aug '21

Ok, thanks for the clarification. That's what I needed to know. --- Regards, Kevin Martin On Thu, Aug 19, 2021 at 12:45 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Thursday, August 19, 2021 1:35 PM -0500 kevin martin > <ktmdms(a)gmail.com> wrote: > > > > > > > i understand that ldap is a protocol but it occurred to me that a > > database change (where tables and the like might be different and slapd > > version dependent) might need to be a sitewide thing, not a server by > > server thing (meaning the 2.4 servers, once the "database" is mirrored > > from the master server, might not understand the new format?). > > The only limitation would be that you could not mdb_copy a 2.5 database > and > run that under a 2.4 slapd. Since it's purely internal, the replication > protocol has no "knowledge" of it, and it would not appear in an LDIF > created by slapcat. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Re: pwdHistory setting not being honored
by kevin martin 19 Aug '21

19 Aug '21

yeah, just found that in the CHANGE file for 2.4. thanks. and that's why I had asked the other question about the 2.4 vs 2.5 database format and servers. figured if I have to update anyway (and should, granted) I should do it to 2.5 but didn't necessarily want to take on a weekends worth of work if I could get away with doing it bit by bit over time. --- Regards, Kevin Martin On Thu, Aug 19, 2021 at 12:33 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Thursday, August 19, 2021 1:17 PM -0500 kevin martin > <ktmdms(a)gmail.com> wrote: > > > > > > > we HAD a password history setting with ppolicy to store 10 passwords in > > history, and that worked fine. Now, our policy has changed and only the > > last 4 passwords can't be used but when I try to change to a password > > that I know was not in the last 4 password changes I'm told that the > > password exists in my history. looking at an ldif dump my user has 10 > > pwdHistory entries but shouldn't the change in policy cause slapd to only > > look at my last 4 most recent pwdHistory entries, because it's certainly > > not doing so. do I have to dump the ldap into an ldif, remove > > pwdHistory entries, and reload it to make the password history stuff work > > correctly? version of slapd is 2.4.45. > > This is <https://bugs.openldap.org/show_bug.cgi?id=8349> > > Fixed in OpenLDAP 2.4.48. I strongly advise upgrading to current > supported > release for many reasons. > > --Quanah > > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

pwdHistory setting not being honored
by kevin martin 19 Aug '21

19 Aug '21

we HAD a password history setting with ppolicy to store 10 passwords in history, and that worked fine. Now, our policy has changed and only the last 4 passwords can't be used but when I try to change to a password that I know was not in the last 4 password changes I'm told that the password exists in my history. looking at an ldif dump my user has 10 pwdHistory entries but shouldn't the change in policy cause slapd to only look at my last 4 most recent pwdHistory entries, because it's certainly not doing so. do I have to dump the ldap into an ldif, remove pwdHistory entries, and reload it to make the password history stuff work correctly? version of slapd is 2.4.45. --- Regards, Kevin Martin

2 1

Re: migrate from 2.4 to 2.5, determine existing MDB format
by kevin martin 19 Aug '21

19 Aug '21

if I have multiple slapd servers running 2.4 can I update my master server to 2.5 with the new format and will the 2.4 mirrors be able to handle the new format or is it an all or nothing upgrade of all servers at once? --- Regards, Kevin Martin On Sat, Aug 7, 2021 at 2:31 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Saturday, August 7, 2021 3:48 PM +0200 Michael Ströder > <michael(a)stroeder.com> wrote: > > > On 8/7/21 1:34 PM, Howard Chu wrote: > >> Michael Ströder wrote: > >>> On 8/7/21 9:58 AM, Michael Ströder wrote: > >>>> On 8/7/21 12:02 AM, Quanah Gibson-Mount wrote: > >>>>> With OpenLDAP 2.5.7 and later it is possible to export a 2.4 > >>>>> database with slapcat in all circumstances. > >>>> > >>>> This will be very helpful because downstream packagers won't have to > >>>> provide two different versions of slapcat (as currently discussed on > >>>> opensuse-factory list). > >>> > >>> Is it sufficient to use commit d00efea7d19ad339f244f1325883031830125876 > >>> as back-port patch? > >> > >> backport into 2.5? Yes. > > > > Yes, of course into 2.5. > > I would also backport: > > commit dffa47ed752fd840e7a7cc0d1b95e4474f2de95b > Author: Howard Chu <hyc(a)openldap.org> > Date: Fri Aug 6 22:13:47 2021 +0100 > > ITS#9611 bconfig: canonicalize structuralObjectclass > > until 2.5.7 is available, as that is also for 2.4 to 2.5 upgrade > compatibility. It affects the dyngroup, dynlist, and memberof overlays. > > --Quanah > > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Antw: [EXT] Re: Index seems to return wrong amount of candidate causing really poor search performance
by Ulrich Windl 19 Aug '21

19 Aug '21

>>> Quanah Gibson-Mount <quanah(a)symas.com> schrieb am 16.08.2021 um 23:20 in Nachricht <45379D5CBFA94DE3B1EA38E5(a)[192.168.1.4]>: > > ‑‑On Monday, August 16, 2021 10:00 PM +0000 Petteri Stenius > <Petteri.Stenius(a)ubisecure.com> wrote: > >> >> Thank you for your quick response. >> >> >> If idlexp is the accepted solution then I'd like to understand how to >> choose correct value for idlexp? >> >> >> I have quickly tested with most values. With my quick tests I could not >> find any significant impact on performance. Setting idlexp to maximum 31 >> did however cause slapd to crash with segmentation fault on my system. > > The appropriate value for any environment is entirely dependent on that > environment's indexing and attribute value distribution for those indexed > attributes. You generally want the minimum value for idlexp that allows > searches to function without performance problems. Increasing the idlexp > size increases slapd memory usage. Keep in mind that every increase in the > idlexp value increases the index slot range by a power of 2. The largest Did you mean "to a power of 2", or do you really mean "by a power of 2"? > value I've ever needed for a massively large db with wide value > distributions was 22. ... Regards, Ulrich

2 3

Re: OpenLDAP 2.5.7 available
by Michael Ströder 18 Aug '21

18 Aug '21

On 8/18/21 8:09 PM, project(a)openldap.org wrote: > OpenLDAP 2.5.7 is now available for download as detailed on our download page: As usual you can find packages for several openSUSE/SLE versions in this OBS project: https://build.opensuse.org/project/show/home:stroeder:openldap25 Feedback welcome! Notes: - Always backup your data before upgrading! - The packages received some packaging fixes and are usable now. - This is my private work not related to the OpenLDAP nor the openSUSE projects => blame me if something looks wrong with the packaging. - If unsure install openldap-ms, not openldap2. This uses a separate prefix /opt/openldap-ms. Ciao, Michael.

1 0

Index seems to return wrong amount of candidate causing really poor search performance
by chrichardso27＠gmail.com 18 Aug '21

18 Aug '21

Hi, Considering the following assumptions; - OpenLDAP version 2.4.51 - attributes objectClass and abc are indexed based on equality - the EQUALITY of attribute abc is based on distinguishedNameMatch - The database contains roughly 2 million entries - 2 entries have defined the attribute abc with a dn value cn=foo,dc=bar and objectClass=someClass - 2 entries have defined the attribute abc with a dn value cn=bar,dc=baz and objectClass=someClass Now, the issue started with really slow search performance using objectClass=someClass & abc=cn=foo,dc=bar as filter criteria. Debugging a while seems to indicate that the objectClass filter returns roughly 2 million entries as candidates. Now, one would expect that the second filter would return only the 2 potential candidates from the abc index, or a subset of the whole database but this is not the case. The second filter also returns nearly the whole database entries as potential candidates and causes really slow query performance. Interestingly, this only occurs when attribute abc has value cn=foo,dc=bar, but for some reason for the entry having attribute abc with value cn=bar,dc=baz the query returns immediately. In both cases, the actual entries matching the search return immediately but for the problematic search "(&(objectClass=someClass)(abc=cn=foo,dc=bar))", the completion of the search takes a long time (around 15 seconds to be precise). The issue started suddenly and wasn't a degradation of query performance over time. Few things I have tried - Rebuilt the whole database again - Reindex the existing database again - Testing with bdb and mdb as backends - Increased cache sizes for bdb to hold the whole database in cache - For bdb adjust the page size of the indexes according to suggestion by db_tuner - Change the order of the filters None of these made any difference. At the moment, there does not seem to be any good options to try. Any ideas or help would be greatly appreciated!

6 18

Configuring OpenLdap Proxy for Mirror-Mode
by Wayne McNaught 17 Aug '21

17 Aug '21

I have previously asked this question with no response 18 months ago, I would still like some assistance I have configured multiple LDAPs in a Mirror-Mode configuration and fronted by OpenLDAP in proxy mode. I understand that the list contained in the DBURI attribute is used to define the backends, and all the proxies are configured with the same list. I understand that first URI in the DbURI attribute will be used unless this fails, in which case it will fall back to the second URI. It will then keep on the second one until that one fails. This seems fine for most failure cases, when all proxies recognise the same failure. If communication fails between one proxy and the one backend LDAP and doesn't affect all proxies, writes will now be directed to different backends from different proxies. Is there some way to keep the proxies in-line or recognise a failure on one proxy and force the others to change. Or is this not needed?

4 4

Re: RE25 testing call #1 (OpenLDAP 2.5.7)
by Nick Folino 17 Aug '21

17 Aug '21

No issues with Fedora 34 On Mon, Aug 16, 2021 at 1:35 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > This is the first testing call for OpenLDAP 2.5.7. Depending on the > results, this may be the only testing call. > > Generally, get the code for RE25: > > < > https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o… > > > > Extract, configure, and build. > > Execute the test suite (via make test) after it is built. Optionally, cd > tests && make its to run through the regression suite. > > Thanks! > > OpenLDAP 2.5.7 Engineering > Fixed lloadd client state tracking (ITS#9624) > Fixed slapd bconfig to canonicalize structuralObjectclass (ITS#9611) > Fixed slapd-mdb multival crash when attribute is missing an equality > matchingrule (ITS#9621) > Fixed slapd-mdb compatibility with OpenLDAP 2.4 MDB databases > (ITS#8958) > Fixed slapd-monitor number of ops executing with asynchronous backends > (ITS#9628) > Fixed slapd-sql to add support for ppolicy attributes (ITS#9629) > Fixed slapd-sql to close transactions after bind and search (ITS#9630) > Fixed slapo-accesslog to make reqMod optional (ITS#9569) > Fixed slapo-ppolicy logging when pwdChangedTime attribute is not > present (ITS#9625) > Documentation > slapo-accesslog(5) note that reqMod is optional (ITS#9569) > Add guide section on load balancer (ITS#9443) > Updated guide to document multiprovider as replacement for > mirrormode (ITS#9200) > Updated guide to clarify slapd-mdb upgrade requirements (ITS#9200) > Updated guide to document removal of deprecated options from > client > tools (ITS#9200) > > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

RE25 testing call #1 (OpenLDAP 2.5.7)
by Quanah Gibson-Mount 16 Aug '21

16 Aug '21

This is the first testing call for OpenLDAP 2.5.7. Depending on the results, this may be the only testing call. Generally, get the code for RE25: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.5.7 Engineering Fixed lloadd client state tracking (ITS#9624) Fixed slapd bconfig to canonicalize structuralObjectclass (ITS#9611) Fixed slapd-mdb multival crash when attribute is missing an equality matchingrule (ITS#9621) Fixed slapd-mdb compatibility with OpenLDAP 2.4 MDB databases (ITS#8958) Fixed slapd-monitor number of ops executing with asynchronous backends (ITS#9628) Fixed slapd-sql to add support for ppolicy attributes (ITS#9629) Fixed slapd-sql to close transactions after bind and search (ITS#9630) Fixed slapo-accesslog to make reqMod optional (ITS#9569) Fixed slapo-ppolicy logging when pwdChangedTime attribute is not present (ITS#9625) Documentation slapo-accesslog(5) note that reqMod is optional (ITS#9569) Add guide section on load balancer (ITS#9443) Updated guide to document multiprovider as replacement for mirrormode (ITS#9200) Updated guide to clarify slapd-mdb upgrade requirements (ITS#9200) Updated guide to document removal of deprecated options from client tools (ITS#9200) Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

order of <what> clauses in ACLs
by Michael Ströder 13 Aug '21

13 Aug '21

HI! Frankly I forgot whether I asked this before: Let there be ACLs with dn.regex="..", attrs=foo,bar and val.regex=".." in the <what> clauses. Obviously depending on complexity of regex-pattern and length of DNs / avals the regex checking is more expensive than equality checking of attrs=. Can I improve ACL performance by order of <what> clauses or are they processed in fixed order anyway? If in fixed order, which one? Ciao, Michael.

3 3

Highly Available Proxies
by Wayne McNaught 12 Aug '21

12 Aug '21

I have asked this question previously and didn't get any answers, really hoping someone can help here this time around. I have configured multiple LDAPs in a Mirror-Mode configuration and fronted by OpenLDAP in proxy mode. I understand that the list contained in the DBURI attribute is used to define the backends, and all the proxies are configured with the same list. I understand that first URI in the DbURI attribute will be used unless this fails, in which case it will fall back to the second URI. It will then keep on the second one until that one fails. This seems fine for most failure cases, when all proxies recognise the same failure. If communication fails between one proxy and the one backend LDAP and doesn't affect all proxies, writes will now be directed to different backends from different proxies. Is there some way to keep the proxies in-line or recognise a failure on one proxy and force the others to change. Or is this not required?

2 1

counters in cn=Waiters,cn=Monitor?
by Michael Ströder 12 Aug '21

12 Aug '21

HI! I'm looking at a Prometheus graph of cn=Read,cn=Waiters,cn=Monitor (slapd 2.4.59). The object class is monitorCounterObject, the attribute is called monitorCounter. If it's a counter I'd expect the value to only increase. But the graph shows decreasing values!?! What's the exact meaning of this? Ciao, Michael.

3 5

Profiling ACLs
by Michael Ströder 12 Aug '21

12 Aug '21

HI! How to profile performance of different ACLs? In theory one could run slapd with debug symbols under control of a profiler for C code. But personally I don't have a clue which ACL processing entry points to examine more closely. Another approach could be to derive metrics from acl-loglevel messages. Any ideas? Ciao, Michael.

3 3

Slow LDAP query with PagedResul control and subtree scope
by thomas＠guirriec.fr 10 Aug '21

10 Aug '21

Hi all, Can someone explain me why there is a difference in behavior (especially response time for the last one) between these 4 LDAP queries ? OpenLDAP 2.4.47 Debian 10 (~300K users) The first three are quick ! : 1) Search with base dn corresponding to an user dn and scope base without PagedResult control : time ldapsearch -LLL -s sub -a always -D '<BIND_DN>' -w 'BIND_PWD' -b "cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" objectclass=* mail dn: cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY> mail: user(a)org.country real 0m0.019s user 0m0.016s sys 0m0.001s Debug : Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: conn=1009 op=1 SRCH base="cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" scope=0 deref=3 filter="(objectClass=*)" Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: conn=1009 op=1 SRCH attr=mail Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: => mdb_search Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: mdb_dn2entry("cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>") Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: => mdb_dn2id("cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>") Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: <= mdb_dn2id: got id=0x41240 Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: => mdb_entry_decode: Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: <= mdb_entry_decode Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: search access to "cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" "entry" requested Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: <= root access granted Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: search access granted by manage(=mwrscxd) Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: base_candidates: base: "cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" (0x00041240) Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: => test_filter Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: PRESENT Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: search access to "cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" "objectClass" requested Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: <= root access granted Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: search access granted by manage(=mwrscxd) Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: <= test_filter 6 Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: => send_search_entry: conn 1009 dn="cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: read access to "cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" "entry" requested Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: <= root access granted Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: read access granted by manage(=mwrscxd) Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: result not in cache (mail) Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: read access to "cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" "mail" requested Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: <= root access granted Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: read access granted by manage(=mwrscxd) Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: result was in cache (mail) Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: result was in cache (mail) Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: conn=1009 op=1 ENTRY dn="cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: <= send_search_entry: conn 1009 exit. Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: send_ldap_result: conn=1009 op=1 p=3 Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: send_ldap_result: err=0 matched="" text="" Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: send_ldap_response: msgid=2 tag=101 err=0 Aug 10 10:46:36 LDAP-CACHE3-R1 slapd[23879]: conn=1009 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= 2) Search with base dn corresponding to an user dn and scope subtree without PagedResult control: time ldapsearch -LLL -s sub -a always -D '<BIND_DN>' -w 'BIND_PWD' -b "cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" objectclass=* mail dn: cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY> mail: user(a)org.country real 0m0.017s user 0m0.006s sys 0m0.007s Debug : Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: conn=1010 op=1 SRCH base="cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" scope=2 deref=3 filter="(objectClass=*)" Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: conn=1010 op=1 SRCH attr=mail Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: => mdb_search Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: mdb_dn2entry("cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>") Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: => mdb_dn2id("cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>") Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: <= mdb_dn2id: got id=0x41240 Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: => mdb_entry_decode: Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: <= mdb_entry_decode Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: search access to "cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" "entry" requested Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: <= root access granted Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: search access granted by manage(=mwrscxd) Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: search_candidates: base="cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" (0x00041240) scope=2 Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: => mdb_filter_candidates Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: #011EQUALITY Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: => mdb_equality_candidates (objectClass) Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: => key_read Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: mdb_idl_fetch_key: [01872a84] Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: <= mdb_index_read: failed (-30798) Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: <= mdb_equality_candidates: id=0, first=0, last=0 Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: <= mdb_filter_candidates: id=0 first=0 last=0 Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: => mdb_filter_candidates Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: #011PRESENT Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: => mdb_presence_candidates (objectClass) Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: <= mdb_filter_candidates: id=-1 first=1 last=299284 Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: mdb_search_candidates: id=-1 first=1 last=299284 Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: => test_filter Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: PRESENT Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: search access to "cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" "objectClass" requested Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: <= root access granted Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: search access granted by manage(=mwrscxd) Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: <= test_filter 6 Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: => send_search_entry: conn 1010 dn="cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: read access to "cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" "entry" requested Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: <= root access granted Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: read access granted by manage(=mwrscxd) Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: result not in cache (mail) Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: read access to "cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" "mail" requested Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: <= root access granted Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: read access granted by manage(=mwrscxd) Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: result was in cache (mail) Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: result was in cache (mail) Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: conn=1010 op=1 ENTRY dn="cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: <= send_search_entry: conn 1010 exit. Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: send_ldap_result: conn=1010 op=1 p=3 Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: send_ldap_result: err=0 matched="" text="" Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: send_ldap_result: conn=1010 op=1 p=3 Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: send_ldap_result: err=0 matched="" text="" Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: send_ldap_response: msgid=2 tag=101 err=0 Aug 10 10:51:24 LDAP-CACHE3-R1 slapd[23879]: conn=1010 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= 3) Search with base dn corresponding to an user dn and scope base with PagedResult control: time ldapsearch -LLL -E pr=500 -s base -a always -D '<BIND_DN>' -w 'BIND_PWD' -b "cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" objectclass=* mail dn: cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY> mail: user(a)org.country # pagedresults: cookie= real 0m0.019s user 0m0.012s sys 0m0.004s Debug : Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: conn=1011 op=1 SRCH base="cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" scope=2 deref=3 filter="(objectClass=*)" scope=0 deref=3 filter="(objectClass=*)" Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: conn=1011 op=1 SRCH attr=mail Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: => mdb_search Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: mdb_dn2entry("cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" scope=2 deref=3 filter="(objectClass=*)") Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: => mdb_dn2id("cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" scope=2 deref=3 filter="(objectClass=*)") Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: <= mdb_dn2id: got id=0x41240 Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: => mdb_entry_decode: Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: <= mdb_entry_decode Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: search access to "cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" scope=2 deref=3 filter="(objectClass=*)" "entry" requested Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: <= root access granted Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: search access granted by manage(=mwrscxd) Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: base_candidates: base: "cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" scope=2 deref=3 filter="(objectClass=*)" (0x00041240) Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: => test_filter Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: PRESENT Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: search access to "cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" scope=2 deref=3 filter="(objectClass=*)" "objectClass" requested Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: <= root access granted Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: search access granted by manage(=mwrscxd) Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: <= test_filter 6 Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: => send_search_entry: conn 1011 dn="cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" scope=2 deref=3 filter="(objectClass=*)" Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: read access to "cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" scope=2 deref=3 filter="(objectClass=*)" "entry" requested Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: <= root access granted Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: read access granted by manage(=mwrscxd) Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: result not in cache (mail) Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: read access to "cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" scope=2 deref=3 filter="(objectClass=*)" "mail" requested Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: <= root access granted Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: read access granted by manage(=mwrscxd) Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: result was in cache (mail) Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: result was in cache (mail) Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: conn=1011 op=1 ENTRY dn="cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" scope=2 deref=3 filter="(objectClass=*)" Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: <= send_search_entry: conn 1011 exit. Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: send_paged_response: lastid=0x00000000 nentries=1 Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: send_ldap_result: conn=1011 op=1 p=3 Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: send_ldap_result: err=0 matched="" text="" Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: send_ldap_response: msgid=2 tag=101 err=0 Aug 10 11:02:09 LDAP-CACHE3-R1 slapd[23879]: conn=1011 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= 4) Search with base dn corresponding to an user dn and scope subtree with PagedResult control: time ldapsearch -LLL -E pr=500 -s base -a always -D '<BIND_DN>' -w 'BIND_PWD' -b "cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" objectclass=* mail dn: cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY> mail: user(a)org.country # pagedresults: cookie= real 0m43.488s user 0m0.013s sys 0m0.000s Debug : Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: conn=1012 op=1 SRCH base="cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" scope=2 deref=3 filter="(objectClass=*)" Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: conn=1012 op=1 SRCH attr=mail Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: => mdb_search Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: mdb_dn2entry("cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>") Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: => mdb_dn2id("cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>") Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: <= mdb_dn2id: got id=0x41240 Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: => mdb_entry_decode: Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: <= mdb_entry_decode Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: search access to "cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" "entry" requested Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: <= root access granted Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: => access_allowed: search access granted by manage(=mwrscxd) Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: search_candidates: base="cn=<USER>,ou=<UNIT>,o=<ORG>,c=<COUNTRY>" (0x00041240) scope=2 Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: => mdb_filter_candidates Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: #011EQUALITY Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: => mdb_equality_candidates (objectClass) Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: => key_read Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: mdb_idl_fetch_key: [01872a84] Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: <= mdb_index_read: failed (-30798) Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: <= mdb_equality_candidates: id=0, first=0, last=0 Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: <= mdb_filter_candidates: id=0 first=0 last=0 Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: => mdb_filter_candidates Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: #011PRESENT Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: => mdb_presence_candidates (objectClass) Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: <= mdb_filter_candidates: id=-1 first=1 last=299284 Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: mdb_search_candidates: id=-1 first=1 last=299284 Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 1 scope not okay Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 2 scope not okay Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 3 scope not okay Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 4 scope not okay Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 5 scope not okay Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 6 scope not okay Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 7 scope not okay Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 8 scope not okay Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 9 scope not okay Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 10 scope not okay Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 11 scope not okay Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 12 scope not okay Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 13 scope not okay Aug 10 11:09:06 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 14 scope not okay ... Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 299265 scope not okay Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 299266 scope not okay Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 299267 scope not okay Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 299268 scope not okay Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 299269 scope not okay Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 299270 scope not okay Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 299271 scope not okay Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 299272 scope not okay Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 299273 scope not okay Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 299274 scope not okay Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 299275 scope not okay Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 299276 scope not okay Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 299277 scope not okay Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 299278 scope not okay Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 299279 scope not okay Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 299280 scope not okay Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 299281 scope not okay Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 299282 scope not okay Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 299283 scope not okay Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: mdb_search: 299284 scope not okay Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: send_paged_response: lastid=0x00000000 nentries=1 Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: send_ldap_result: conn=1012 op=1 p=3 Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: send_ldap_result: err=0 matched="" text="" Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: send_ldap_result: conn=1012 op=1 p=3 Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: send_ldap_result: err=0 matched="" text="" Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: send_ldap_response: msgid=2 tag=101 err=0 Aug 10 11:09:50 LDAP-CACHE3-R1 slapd[23879]: conn=1012 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= It's as if the last request iterate over all entries matching with objectclass=*. Is this the expected behavior ? Thomas

1 0

migrate from 2.4 to 2.5, determine existing MDB format
by Michael Ströder 07 Aug '21

07 Aug '21

HI! As far as I understood the MDB disk format changed. So the MDB files have to be re-created (either by simply removing/replicating or slapcat/slapadd). Right? Now I'm wondering how to automate things (with ansible and puppet) in a truly idempotent way. Ideally I could determine whether existing MDB files were last maintained by OpenLDAP 2.4.x or whether they already have the 2.5 format. Can I find out the disk format version in any way, e.g. with python-lmdb? Ciao, Michael.

6 18

Modifying value with MDB_WRITEMAP outside of mdb_cursor_put
by mnunberg＠haskalah.org 05 Aug '21

05 Aug '21

I'm trying to plug LMDB into a system where the user first modifies the value, and only afterwards notifies me that the value has been changed. In LMDB I've been simply passing the value pointer received from mdb_cursor_get (db opened with MDB_WRITEMAP), and if the user notifies me that the value has been changed, I commit the write transaction. Is this an acceptable use pattern? It seems to work (but crashes without MDB_WRITEMAP). Only thing vaguely related I could find here was https://www.openldap.org/lists/openldap-technical/201510/msg00016.html

2 1

Modify memberOf olcAttributetype in schema
by shekhar.shrinivasan＠gmail.com 05 Aug '21

05 Aug '21

Hi, There is a specific requirement where the client needs the memberOf attribute to be returned by default. As per the current design the memberOf attribute is of type operational and thus needs to be explicitly asked for. Is there a easy way to update the schema and change the type of the attribute from Operational to userApplication so that the attribute will be returned by default ? I tried to update the schema using a ldif file but I am getting the following error:- error code 80 - olcAttributeTypes: Duplicate attributeType: 1.2.840.113556.1.2.102 Please assist with this request. My Ldif is as follows:- dn: cn=schema,cn=config changetype: modify delete: olcAttributeTypes olcAttributeTypes: ( 1.2.840.113556.1.2.102 NAME 'memberOf' DESC 'Group that the entry belongs to' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 USAGE dSAOperation X-ORIGIN 'iPlanet Delegated Administrator' ) - add: olcAttributeTypes olcAttributeTypes: ( 1.2.840.113556.1.2.102 NAME 'memberOf' DESC 'Group that the entry belongs to' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )

5 7

ldap utils: option dropped
by A. Schulze 04 Aug '21

04 Aug '21

Hello, in openldap-2.5.6, ldapsearch no longer understand '-h' to specify an LDAP server. '-H' must be uses now everywhere. Yes, it makes sense, but it break some things here. So I read https://www.openldap.org/doc/admin25/appendix-changes.html and https://www.openldap.org/doc/admin25/appendix-upgrading.html but did not found documentation for this change. I hoped to find also information about other potential changes to plan the 2.4 -> 2.5 migration. Are there other places I may search for documentation? Andreas

2 1

Generating a memberOf attribute for posixGroups (dynlist module)
by Eduardo Lúcio Amorim Costa 03 Aug '21

03 Aug '21

According to this post http://blog.oddbit.com/post/2013-07-22-generating-a-membero/ it is possible to use a strategy for generating a memberOf attribute for posixGroups (dynlist module). This need arose for a legacy OpenLDAP LDAP and with several applications using it. So, this seems to me the best solution to be able to use the memberOf as a filter. NOTE: Complete information about the problem here https://stackoverflow.com/questions/68583838/ldap-add-a-filter-to-an-ldap-u… ). *QUESTION:* Has anyone tested/used the procedure in the post http://blog.oddbit.com/post/2013-07-22-generating-a-membero/ ? Ie, generating a memberOf attribute for posixGroups (dynlist module)? What I have for group OU and user OU is what goes below... *GROUP* ``` cn: accessgroup gidNumber: 1004 memberUid: usera userb userc userd usere userf userg userh useri objectClass: top posixGroup ``` *USERS* ``` cn: User Letter A gecos: User Letter A gender: M gidNumber: 544 givenName: User gotoLastSystemLogin: 01.01.1970 00:00:00 homeDirectory: /home/usera loginShell: /bin/bash mail: user.letter.a(a)domain.abc.de objectClass: top person organizationalPerson inetOrgPerson gosaAccount posixAccount shadowAccount sambaSamAccount [...] uid: usera uidNumber: 1004 [...] ``` *Thanks! =D* -- *Eduardo Lúcio* Tecnologia, Desenvolvimento e Software Livre LightBase Consultoria em Software Público eduardo.lucio(a)lightbase.com.br <eduardo.lucio(a)LightBase.com.br> *+55-61-3347-1949* - http://brlight.org <eduardo.lucio(a)LightBase.com.br> - *Brasil-DF* *Software livre! Abrace essa idéia! * *"Aqueles que negam liberdade aos outros não a merecem para si mesmos."* *Abraham Lincoln*

3 5

Re: Generating a memberOf attribute for posixGroups (dynlist module)
by Eduardo Lúcio Amorim Costa 30 Jul '21

30 Jul '21

Hi people! My version is the one below... ``` [root@ldap_provider ~]# slapd -VV @(#) $OpenLDAP: slapd 2.4.44 (Apr 28 2021 13:32:00) $ mockbuild(a)x86-02.bsys.centos.org: /builddir/build/BUILD/openldap-2.4.44/openldap-2.4.44/servers/slapd ``` ...anything else you can tell us? PLUS: Is this procedure safe? Have you ever used it? []'s Em sex., 30 de jul. de 2021 às 13:37, Quanah Gibson-Mount <quanah(a)symas.com> escreveu: > > > --On Friday, July 30, 2021 2:30 PM -0300 Eduardo Lúcio Amorim Costa > <eduardolucioac(a)gmail.com> wrote: > > > > > > > According to this post > > http://blog.oddbit.com/post/2013-07-22-generating-a-membero/ it is > > possible to use a strategy for generating a memberOf attribute for > > posixGroups (dynlist module). > > > > This need arose for a legacy OpenLDAP LDAP and with several applications > > using it. > > > > So, this seems to me the best solution to be able to use the memberOf as > > a filter. > > You want OpenLDAP 2.5's version of dynlist. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > -- *Eduardo Lúcio* Tecnologia, Desenvolvimento e Software Livre LightBase Consultoria em Software Público eduardo.lucio(a)lightbase.com.br <eduardo.lucio(a)LightBase.com.br> *+55-61-3347-1949* - http://brlight.org <eduardo.lucio(a)LightBase.com.br> - *Brasil-DF* *Software livre! Abrace essa idéia! * *"Aqueles que negam liberdade aos outros não a merecem para si mesmos."* *Abraham Lincoln*

2 2

Configure openldap 2.5.6 on CentOS7 with TLS
by Scott Classen 30 Jul '21

30 Jul '21

Hello, I’m making some progress with building 2.5.6 on my CentOS 7 machine, but I am stuck getting TLS support First I installed openssl version 1.1.1 from the epel repository: sudo yum install openssl11.x86_64 sudo yum install openssl11-devel.x86_64 sudo yum install openssl11-libs.x86_64 sudo yum install openssl11-static.x86_64 Then download and configure openldap: wget https://www.openldap.org/software/download/OpenLDAP/openldap-release/openld… tar zxvf openldap-2.5.6.tgz cd openldap-2.5.6/ CPPFLAGS=-I/usr/include/openssl11 export CPPFLAGS ./configure --with-tls=openssl [snip] checking openssl/ssl.h usability... yes checking openssl/ssl.h presence... yes checking for openssl/ssl.h... yes checking for SSL_export_keying_material_early in -lssl... no configure: error: Could not locate TLS/SSL package Any idea how I might get past this? I can configure, make depend, and make if I don’t specify the "--with-tls=openssl” option, but my understanding was that TLS was essential for OpenLDAP. Thanks, Scott

3 3

Re: Much Higher Latency With Paged Results Asked
by Romain Madala 28 Jul '21

28 Jul '21

Hi, I'm trying to understand what I can do to reduce the time needed by slapd to answer one simple query even though using the paging response option. When I do my request without pr switch it takes 5 ms, but if i do use the option it's around 105ms. Question is why ? And how I can get back to 5 ms when using the option ? Thanks Le mer. 28 juil. 2021 à 21:10, Quanah Gibson-Mount <quanah(a)symas.com> a écrit : > > > --On Tuesday, July 27, 2021 8:13 PM +0200 Romain Madala > <romain.madala(a)gmail.com> wrote: > > > Please provide additional details of the issue. > > Thanks, but you didn't answer the above. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Re: Much Higher Latency With Paged Results Asked
by Romain Madala 28 Jul '21

28 Jul '21

Hi, I'm using "Ubuntu 20.04.2 LTS" slapd is : apt-cache policy slapd slapd: Installed: 2.4.49+dfsg-2ubuntu1.8 My DB backend is olcDatabase={1}mdb.ldif, If you need further details, please provide me with the commands because I'm quite a newbie. Thanks in advance, Le mar. 27 juil. 2021 à 17:00, Quanah Gibson-Mount <quanah(a)symas.com> a écrit : > > > --On Tuesday, July 27, 2021 1:50 PM +0000 romain.madala(a)gmail.com wrote: > > > Hi, > > > > Is there anyone who could help me to figure out this behaviour ? > > What release of OpenLDAP are you running? What database backend are you > using? Please provide additional details of the issue. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Re: OpenLDAP 2.5.6 available
by Michael Ströder 27 Jul '21

27 Jul '21

On 7/27/21 8:31 PM, project(a)openldap.org wrote: > OpenLDAP 2.5.6 is now available As usual you can find packages for several openSUSE/SLE versions in this OBS project: https://build.opensuse.org/project/show/home:stroeder:openldap25 Feedback welcome! Notes: - The packages are still considered experimental and not tested in production. This is not a statement about OpenLDAP 2.5.6 itself. - This is my private work not related to the OpenLDAP nor the openSUSE projects => blame me if something looks wrong with the packaging. - If unsure install openldap-ms, not openldap2. This uses a separate prefix /opt/openldap-ms. Ciao, Michael.

1 0

Much Higher Latency With Paged Results Asked
by Romain Madala 27 Jul '21

27 Jul '21

Hi, Could someone explain to me why I get ~100 ms latency when I query with a *-E pr=500* option while it usually takes 5 ms if I query the same without the option ? Question is raised because I use a solution which unfortunately query with the option even though there is no real need to do so, and can make up to 100K requests in a row, So eventually with a 100 ms latency x 100 k request, the global wait time can get very ugly. Thanks in advance,

3 2

adding a new module smbkrb5pwd - error missingAttributeDescription
by Heinemann, Peter G 23 Jul '21

23 Jul '21

Hello, Using: openldap 2.4.58 RHEL 8 I'm attempting to add a new module, smbkrb5pwd (because we use MIT Kerberos). Compiled and linked under the full openldap2.4.58 source tree per instructions (README and here https://github.com/opinsys/smbkrb5pwd) ldapadd is failing, the log shows: conn=19701 op=1 ADD dn="cn=module{0},cn=config" Jul 22 12:15:58 slapd[605702]: lt_dlopenext failed: (smbkrb5pwd.so) file not found Jul 22 12:15:58 slapd[605702]: conn=19701 op=1 RESULT tag=105 err=80 text=<olcModuleLoad> handler exit Using this ldif: dn: cn=module{0},cn=config objectClass: olcModuleList cn: module olcModulepath: /etc/openldap/smbkrb5pwd olcModuleload: {0}smbkrb5pwd.so I've tried olcModuleload with the full path, or olcModulepath with just the module name and still get the lt_dlopenext The directory and files are visible: ll /etc/openldap/smbkrb5pwd/smbkrb5pwd.* -rw-r--r--. 1 ldap ldap 145638 Jul 22 12:13 /etc/openldap/smbkrb5pwd/smbkrb5pwd.a -rw-r--r--. 1 ldap ldap 888 Jul 22 12:13 /etc/openldap/smbkrb5pwd/smbkrb5pwd.la -rw-r--r--. 1 ldap ldap 889 Jul 22 12:13 /etc/openldap/smbkrb5pwd/smbkrb5pwd.lai -rw-r--r--. 1 ldap ldap 146720 Jul 22 12:13 /etc/openldap/smbkrb5pwd/smbkrb5pwd.o lrwxrwxrwx. 1 root root 19 Jul 22 12:13 /etc/openldap/smbkrb5pwd/smbkrb5pwd.so -> smbkrb5pwd.so.0.0.1 lrwxrwxrwx. 1 root root 19 Jul 22 12:13 /etc/openldap/smbkrb5pwd/smbkrb5pwd.so.0 -> smbkrb5pwd.so.0.0.1 -rwxr-xr-x. 1 ldap ldap 97624 Jul 22 12:13 /etc/openldap/smbkrb5pwd/smbkrb5pwd.so.0.0.1 Thanks for any guidance as to what I've missed in the setup. Peter

4 4

RE25 testing call #1 (OpenLDAP 2.5.6)
by Quanah Gibson-Mount 22 Jul '21

22 Jul '21

This is the first testing call for OpenLDAP 2.5.6. Depending on the results, this may be the only testing call. Generally, get the code for RE25: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.5.6 Engineering Fixed libldap buffer overflow (ITS#9578) Fixed libldap missing mutex unlock on connection alloc failure (ITS#9590) Fixed lloadd cn=config olcBkLloadClientMaxPending setting (ITS#8747) Fixed slapd multiple config defaults (ITS#9363) Fixed slapd ipv6 addresses to work with tcp wrappers (ITS#9603) Fixed slapo-syncprov delete of nonexistent sessionlog (ITS#9608) Build Fixed library symbol versioning on Solaris (ITS#9591) Fixed compile warning in libldap/tpool.c (ITS#9601) Fixed compile wraning in libldap/tls_o.c (ITS#9602) Contrib Fixed ppm module for sysconfdir (ITS#7832) Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Replacing memberof with dynlist
by j.vandeville＠gmail.com 16 Jul '21

16 Jul '21

Hello, Apologies for my bad English, it's not my native langage I'm toying with openldap 2.5.5 and the dynlist overlay to replace the memberof overlay (since it's the recommanded way to manage the memberof attribute in a replicate environnement). My configuration for the dynlist overlay is like this : overlay dynlist dynlist-attrset groupOfURLs memberURL memberOf If I create a group like this : dn: cn=GroupB,ou=Groups,dc=appartement,dc=me objectClass: posixGroup objectClass: top objectClass: groupOfNames cn: GroupB member: uid=bob,ou=Users,dc=appartement,dc=me gidNumber: 14056 and a user like this : dn: uid=bob,ou=Users,dc=appartement,dc=me objectClass: posixAccount objectClass: top objectClass: inetOrgPerson objectClass: shadowAccount objectClass: groupOfURLs [...Attributes omitted for clarity...] givenName: bob sn: bob displayName: bob uid: bob memberURL: ldap:///ou=Groups,dc=appartement,dc=me??sub?(member=uid=bob,ou=Users,dc=appartement,dc=me) everything works fine, the memberof attribute is generate on the fly if I request it in the search My "issue" is that my LDAP Client is not capable of creating a posix account with the objectclass groupOfURLs or the memberURL attribute... So when I create a new user, I need to manually edit the user in the database to add the objectclass groupOfURLs and the memberURL, which is very tedious. Is there a way for openldap to dynamically add theses attributes when a new user is created ? For exemple, my LDAP client send an "Addrequest" with the following attributes : dn: uid=leon,ou=Users,dc=appartement,dc=me objectClass: posixAccount objectClass: top objectClass: inetOrgPerson objectClass: shadowAccount [...Attributes omitted for clarity...] givenName: leon sn: leon displayName: leon uid: leon openldap intercept the request, add the following attributes : objectClass: groupOfURLs memberURL: ldap:///ou=Groups,dc=appartement,dc=me??sub?(member=uid=bob,ou=Users,dc=appartement,dc=me) and then write the new entry in the database. Is that possible ? I looked at slapo-rwm but I'm not sure if this overlay can add attributes... Thanks !

2 2

Re: Symas OpenLDAP for Linux 2.5
by Dave Macias 15 Jul '21

15 Jul '21

> > Yes, although we haven't yet announced it since it's still a WIP. > I see. So if I understand correctly, the 2.5 release is good to go, but the packaged (rpm/deb/etc) files are still WIP? Best, Dave

2 1

Re: Symas OpenLDAP for Linux 2.5
by Dave Macias 14 Jul '21

14 Jul '21

Looking at: https://repo.symas.com/sofl/ They mention 2.4.59.1 But looks like the baseurl for 2.5 is now: https://repo.symas.com/repo/rpm/SOLDAP/release25/ Yes? Thanks, Dave On Wed, Jul 14, 2021 at 11:19 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Tuesday, July 13, 2021 5:37 PM -0700 "Paul B. Henson" <henson(a)acm.org> > > wrote: > > > We're currently using the RHEL8 sofl repo, which currently has version > > 2.4.59.1 available. Our management wants to start doing automatic > > updates to the latest patches for security compliance reasons. This > > isn't an issue with the native RHEL repos as they generally never > > release major updates or incompatible packages. > > > > I wanted to check though how the release of openldap 2.5 via sofl is > > going to be handled. Is it just going to show up one day in the existing > > repo such that it would automatically get upgraded to, or is it going to > > be a different package name or a new repo that will require manual > > intervention in order to upgrade? > > Symas OpenLDAP packages for 2.5 will be an entirely different beast. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Symas OpenLDAP for Linux 2.5
by Paul B. Henson 14 Jul '21

14 Jul '21

We're currently using the RHEL8 sofl repo, which currently has version 2.4.59.1 available. Our management wants to start doing automatic updates to the latest patches for security compliance reasons. This isn't an issue with the native RHEL repos as they generally never release major updates or incompatible packages. I wanted to check though how the release of openldap 2.5 via sofl is going to be handled. Is it just going to show up one day in the existing repo such that it would automatically get upgraded to, or is it going to be a different package name or a new repo that will require manual intervention in order to upgrade? Thanks...

2 1

password complexity controls and gecos
by kevin martin 08 Jul '21

08 Jul '21

using ppolicy and a Default User Policy, along with ppm, I achieve the ability to control password length, password history, and complexity in as much as I can regulate that users must include numbers/special characters/letters (upper and lower case). However, what I can't find a way to add to this is to have the gecos field be checked against the password being submitted during a change to verify that a users userid and/or first or last names aren't part of the password. Is this possible in openldap? --- Regards, Kevin Martin

2 1

Consumer Delta Sync Lost After Provider Restarted
by thomaswilliampritchard＠gmail.com 07 Jul '21

07 Jul '21

Hi, I'm experiencing an issue between my 3 providers and multiple consumer setup and delta sync repl. We manage a primary, or active, provider and send all writes to the primary as long as it's healthy letting the two others replicate and be standby providers ready to take over in the event of a failure. All consumers replicate from all providers and all providers replicate from all providers. After the system was running healthily for over a week a standby provider was restarted. This caused my consumers to re-establish the persistent sync connection. Upon re-establishing the connection, some consumers began a sync refresh with the following message. Jun 28 18:32:55 openldap-hdb-consumer slapd[15746]: do_syncrep1: rid=003 starting refresh (sending cookie=rid=003,csn=20210331192036.214412Z#000000#000#000000;20210119225955.133811Z#000000#001#000000;20210128213906.596429Z#000000#002#000000;20210226190704.219043Z#000000#005#000000;20210412181659.152626Z#000000#065#000000;20210610231714.990702Z#000000#066#000000;20210614191744.122968Z#000000#44d#000000;20210412175600.595586Z#000000#835#000000;20210423182110.684843Z#000000#836#000000;20210331193249.570935Z#000000#ce5#000000) Jun 28 18:32:55 openldap-hdb-consumer slapd[15746]: do_syncrep2: rid=003 LDAP_RES_SEARCH_RESULT Jun 28 18:32:55 openldap-hdb-consumer slapd[15746]: do_syncrep2: rid=003 delta-sync lost sync, switching to REFRESH Jun 28 18:32:55 openldap-hdb-consumer slapd[15746]: do_syncrep2: rid=003 (4096) Content Sync Refresh Required This was re-establishing a connection with rid=003 which is "20210412175600.595586Z#000000#835#000000" (a standby system) however we have only been sending writes to server #44d# (the primary provider). We see 44d CSN is over 7 days old, beyond our providers access log period. On the consumer that did not trigger sync refresh we see Jun 28 18:32:55 openldap-hdb-consumer slapd[24439]: do_syncrep1: rid=003 starting refresh (sending cookie=rid=003,csn=20210331192036.214412Z#000000#000#000000;20210119225955.133811Z#000000#001#000000;20210128213906.596429Z#000000#002#000000;20210226190704.219043Z#000000#005#000000;20210412181659.152626Z#000000#065#000000;20210621212459.620195Z#000000#066#000000;20210621214400.407867Z#000000#44d#000000;20210412175600.595586Z#000000#835#000000;20210423182110.684843Z#000000#836#000000;20210331193249.570935Z#000000#ce5#000000) Here we see 20210621214400.407867Z#000000#44d#000000 is much more recent and did not trigger a full resync, although it is close to the 7 day threshold at this point. We notice the rid=003 835 csn is the same as the consumer experiencing the problem which makes me believe the #44d# csn being old is what causes this sync refresh. I am concerned why when the standby provider is restarted the connection is getting re-established with old provider CSNs, when I search the CSNs on the consumers they look newer than the ones used to reestablish the connection. If we restart slapd on the providers after running consumers for 7 days it seems like it will trigger a sync refresh. How can we make the consumers re-establish the connection with the most recent CSN? Replication is working as expected, just the CSNs seem to remain old in this connection message. The sync refresh behavior causes a large load on the consumers and providers spiking bind times and degrading service making this concerning for our production environment. Configuration details are below. Your insights are appreciated. @(#) $OpenLDAP: slapd 2.4.56 (Dec 14 2020 17:31:23) $ @57af0b7ce0ba:/root/rpmbuild/BUILD/openldap-2.4.56/openldap-2.4.56/servers/slapd Provider config Primary DB # {2}mdb, config dn: olcDatabase={2}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {2}mdb olcDbDirectory: /var/lib/ldap ... olcSizeLimit: unlimited olcSyncrepl: {0}rid=1 provider=ldap://10.20.0.4 bindmethod=simple binddn ="cn=replicant,dc=example,dc=com" credentials="" searchbase="dc=example,dc=com" schemachecking=on type=refresh AndPersist retry="5 10 60 +" sizelimit=unlimited timelimit=unlimited starttls=critical tls_reqcert=demand logbase="cn=accesslog" logfilter=" (&(objectClass=auditWriteObject)(reqResult=0))" syncdata=accesslog olcSyncrepl: {1}rid=2 provider=ldap://10.20.1.151 bindmethod=simple bind dn="cn=replicant,dc=example,dc=com" credentials="" searchbase="dc=example,dc=com" schemachecking=on type=refre shAndPersist retry="5 10 60 +" sizelimit=unlimited timelimit=unlimited starttls=critical tls_reqcert=demand logbase="cn=accesslog" logfilter ="(&(objectClass=auditWriteObject)(reqResult=0))" syncdata=accesslog olcSyncrepl: {2}rid=3 provider=ldap://10.20.2.240 bindmethod=simple bind dn="cn=replicant,dc=example,dc=com" credentials="" searchbase="dc=example,dc=com" schemachecking=on type=refre shAndPersist retry="5 10 60 +" sizelimit=unlimited timelimit=unlimited starttls=critical tls_reqcert=demand logbase="cn=accesslog" logfilter ="(&(objectClass=auditWriteObject)(reqResult=0))" syncdata=accesslog olcMirrorMode: TRUE ... olcDbMaxSize: 15000000000 Sync Prov # {1}syncprov, {2}mdb, config dn: olcOverlay={1}syncprov,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov olcSpCheckpoint: 1 1 Access Log # {3}accesslog, {2}mdb, config dn: olcOverlay={3}accesslog,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {3}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogPurge: 07+00:00 01+00:00 olcAccessLogSuccess: TRUE # {3}mdb, config dn: olcDatabase={3}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {3}mdb olcDbDirectory: /var/lib/ldap/accesslog olcSuffix: cn=accesslog olcRootDN: cn=admin,dc=example,dc=com olcDbIndex: default eq olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart olcDbMaxSize: 15000000000 # {0}syncprov, {3}mdb, config dn: olcOverlay={0}syncprov,olcDatabase={3}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE olcSpReloadHint: TRUE Consumer Config: # {2}hdb, config dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=example,dc=com olcRootDN: cn=admin,dc=example,dc=com olcRootPW: {SSHA} olcSyncrepl: {0}rid=1 provider=ldap://10.20.0.4 bindmethod=simple binddn ="cn=replicant,dc=example,dc=com" credentials="" searchbase="dc=example,dc=com" schemachecking=on type=refresh AndPersist retry="60 +" sizelimit=unlimited timelimit=unlimited start tls=critical tls_reqcert=demand logbase="cn=accesslog" logfilter="(&(ob jectClass=auditWriteObject)(reqResult=0))" syncdata=accesslog olcSyncrepl: {1}rid=2 provider=ldap://10.20.1.151 bindmethod=simple bind dn="cn=replicant,dc=example,dc=com" credentials="" searchbase="dc=example,dc=com" schemachecking=on type=refre shAndPersist retry="60 +" sizelimit=unlimited timelimit=unlimited sta rttls=critical tls_reqcert=demand logbase="cn=accesslog" logfilter="(&( objectClass=auditWriteObject)(reqResult=0))" syncdata=accesslog olcSyncrepl: {2}rid=3 provider=ldap://10.20.2.240 bindmethod=simple bind dn="cn=replicant,dc=example,dc=com" credentials="" searchbase="dc=example,dc=com" schemachecking=on type=refre shAndPersist retry="60 +" sizelimit=unlimited timelimit=unlimited sta rttls=critical tls_reqcert=demand logbase="cn=accesslog" logfilter="(&( objectClass=auditWriteObject)(reqResult=0))" syncdata=accesslog olcDbCheckpoint: 102400 10

2 4

Are Password Expired and Password Expiry warning (2.16.840.1.113730.3.4.5) controls supported in OpenLDAP
by cst labs 06 Jul '21

06 Jul '21

hello: I am currently evaluating the OpenLDAP version 2.4.58. I was told by someone that it does support the password expired control but I don't see that it is working. As per the RFC, the server should send this control as a part of response but it doesn't. I do see that the server returns the password policy state control that has expired and warning information. However, I am interested in the password expired control since I am looking to support an existing implementation that leverages that control. Can someone tell me how to configure openldap to return that control?

3 2

enable WiredTiger not defaulting to no
by dbray925+openldap＠gmail.com 30 Jun '21

30 Jun '21

I'm currently testing out the 2.5.5 install, and during the configure process it fails with: configure: error: Package requirements (wiredtiger) were not met: Package 'wiredtiger', required by 'virtual:world', not found The documentation (--help) shows that this should be default to no: --enable-wt enable WiredTiger backend no|yes|mod [no] However, this is not the case, and I have to manually set: ./configure --enable-wt=no

3 4

OpenLDAP & IDN support
by trantorvega＠gmail.com 30 Jun '21

30 Jun '21

Hello everyone. I am writing here (hopefully it's the right list for the topic) to ask about IDN (Internationalized Domain Names) support in OpenLDAP and LDAP in general. I've been perusing IETF documents and all I could find was a couple of expired drafts, 18 and 20 years old, pertaining the topic. https://datatracker.ietf.org/doc/draft-hall-ldap-idn/ https://datatracker.ietf.org/doc/draft-zeilenga-ldap-idn/ Does anyone have more information on the topic and maybe on why those drafts went nowhere? Thanks in advance, Fulvio Scapin

4 5

How to delete entries from cn=config with openldap-2.5
by Francesco Malvezzi 30 Jun '21

30 Jun '21

hi all, does the "Better cn=config functionality" enhancement in openldap-2.5 include the deletability of entries (like a module)? Should this: sudo ldapdelete -H ldapi:/// -Y EXTERNAL cn=module{0},cn=config work and what am I missing? thank you, Francesco

2 1

totp1andpw
by Stefan Kania 28 Jun '21

28 Jun '21

Hi to all, I'm still testing TOPT with OpenLDAP 2.5. I got TOTP1 running. So a user with an OTP can use the six-digit number from googleauthenticator (or freeOTP+) to authenticate while using ldapsearch. Then I switch to TOTP1ANDPW I generate a secretkey for the TOTP-part of userPassword. Then I create a password with "slappasswd" and put both TOTP1|password together in userPassword after decoding base64 I saw what I expected: ------------ dn: cn=u1,ou=users,dc=example,dc=net objectClass: posixAccount objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: autoCAuser loginShell: /bin/bash homeDirectory: /home/u1 uid: u1 uidNumber: 10010 gidNumber: 10000 sn: u givenName: 1 cn: u1 userPassword:: e1RPVFAxQU5EUFd9TUpBVk1UM0tNUlVXSVNDUEtKWEhJWVNaR1kzRE80Q0x8e1N TSEF9RWlCcVIwUGR4SUluMSswZTNqRSs1MXlwb1p6dTFKVUc= ------------------ echo "e1RPVFAxQU5EUFd9TUpBVk1UM0tNUlVXSVNDUEtKWEhJWVNaR1kzRE80Q0x8e1NTSEF9RWlCcVIwUGR4SUluMSswZTNqRSs1MXlwb1p6dTFKVUc=" | base64 -d {TOTP1ANDPW}MJAVMT3KMRUWISCPKJXHIYSZGY3DO4CL|{SSHA}EiBqR0PdxIIn1+0e3jE+51ypoZzu1JUG I then try to authenticate using ldapsearch with: 123456secret where 123456 is the six-digit key from googleauthenticator and "secret" is the password. But I always got an error 49 :-( I read this to set up the password: https://git.openldap.org/ondra/openldap/-/tree/dfe1f6494d69a885477e854944a6… Any hint? Anyone who got this running? I wrote a little bash-script to generate the shared-key, the password and write it into the users object: THIS SCRIPT IS FOR TESTING PURPOSE ONLY! ----------------------------- #!/bin/bash ########################################## # This script requires an OpenLDAP 2.5.x # # with the overlay pw-totp and autoca # # active and configured! # ########################################## # This script generats a TOTP1ANDPW password for a user # the script needs the full DN of the user # and an email address for the user. # The script will NOT check if the email address is valide # Ther will be a random string generated for the user # the user do not need the string. The string is only # to generate the sharedkey for the user. # At the end you will see the sharedkey, the user can enter # in an authenticator app like googleauthentiicator or freeOTP # and a png-file will be created with the QR-code for the sharedkey # # The script can be used via network or local only via the ldapi-socket if [ $# -ne 2 ] then echo "User-DN and User-Mail is needed" echo "usage: $0 userdn user@mail" exit 1 fi USER_DN=$1 USER_MAIL=$2 LDAP_SERVER=ldap://ldap25-p01.example.net USE_LDAPI=1 # set to "0" if userlogin is prefered USE_TLS=1 # if TLS should not be used set to "0" #LDAP_ADMIN="uid=ldap-admin,ou=users,dc=example,dc=net" LDAP_ADMIN="cn=admin,dc=example,dc=net" LDAP_ADMIN_PW="secret" TOPT_ISSUER=stka USER_PW_TOTP_BASE64="" USER_NAME="" USER_SHARED_KEY="" QR_TEXT="" USER_PASSWORD="" # Setting the varaible to use TLS if selected if [ "$USE_TLS" -eq 1 ] then ACTIVATE_TLS="-ZZ" else ACTIVATE_TLS="" fi if [ ! -f "/usr/bin/qrencode" ] then echo "qrencode is not installed!" exit 2 fi #First part of DN is USER_MANE USER_NAME=$(echo "$USER_DN" | cut -d "," -f 1) # Let's get shure that there is exactly one user present in database if [ $USE_LDAPI -eq 1 ] then USER_DN_IN_DB=$(ldapsearch -Q -Y EXTERNAL -LLL -H ldapi:/// $USER_NAME dn 2>/dev/null | cut -d " " -f 2) else USER_DN_IN_DB=$(ldapsearch -xLLL "$ACTIVATE_TLS" -D "$LDAP_ADMIN" -w "$LDAP_ADMIN_PW" -H "$LDAP_SERVER" "$USER_NAME" dn 2>/dev/null | cut -d " " -f 2) fi if [ "${USER_DN,,}" != "${USER_DN_IN_DB,,}" ] then echo "User $USER_DN not found in database" exit 3 fi #Create random 20 byte string: 160 bit is recommended (min 128 bit) USER_PW=$(tr -dc A-Za-z0-9 </dev/urandom | head -c 20 ; echo '') #Create the password for 2fa USER_PASSWORD=$(slappasswd) #Set user password if [ $USE_LDAPI -eq 1 ] then ldappasswd -Q -Y EXTERNAL -H ldapi:/// -s "${USER_PW}|${USER_PASSWORD}" "$USER_DN" else ldappasswd -x "$ACTIVATE_TLS" -D "$LDAP_ADMIN" -w "$LDAP_ADMIN_PW" -s "${USER_PW}|${USER_PASSWORD}" "$USER_DN" fi #Read user password from LDAP in TOTP1-format if [ $USE_LDAPI -eq 1 ] then PW_STEP_1=$(ldapsearch -Q -Y EXTERNAL -LLL -H ldapi:/// "$USER_NAME" userpassword | grep -A1 userPassword) USER_PW_TOTP_BASE64=$(echo $PW_STEP_1 | awk '{print $2 $3}') else USER_PW_TOTP_BASE64=$(ldapsearch -x "$ACTIVATE_TLS" -D "$LDAP_ADMIN" -w "$LDAP_ADMIN_PW" -LLL -H "$LDAP_SERVER" "$USER_NAME" userpassword | grep userPassword | cut -d " " -f 2 | cut -d '|' -f 1) fi #Create user shared key USER_SHARED_KEY=$(echo $USER_PW_TOTP_BASE64 | base64 -d) #cut the password hash type from shared key USER_SHARED_KEY=$(echo $USER_SHARED_KEY | cut -d "|" -f 1 | cut -d "}" -f 2) #Create the QR-text for the user QR_TEXT="otpauth://totp/$LDAP_SERVER:$USER_MAIL?secret=${USER_SHARED_KEY}a&issuer=${TOTP_ISSUER}&period=30&digits=6&algorithm=SHA1" #Generate the QR-code echo $QR_TEXT | qrencode -s9 -o ${USER_MAIL}.png echo "Shared key for User $USER_DN is $USER_SHARED_KEY" echo "You find the QR-code in file ${USER_MAIL}.png" -----------------------------

6 7

slapd does not start after upgrade
by BÖSCH Christian 22 Jun '21

22 Jun '21

Hi, I've upgraded openldap 2.4.57 to 2.4.59 on FreeBSD 12.2 using portmaster, what has always worked over the last few years. After upgrade the config seems to be bad which hasn't changed…? root@openldap2:/usr/local/etc/openldap # /usr/local/libexec/slapd -Tt -u 60d0a1cd PROXIED attributeDescription "O" inserted. 60d0a1cd UNKNOWN attributeDescription "OLCRWMTFSUPPORT" inserted. 60d0a1cd UNKNOWN attributeDescription "OLCRWMNORMALIZEMAPPED" inserted. 60d0a1cd UNKNOWN attributeDescription "OLCRWMREWRITE" inserted. 60d0a1cd config error processing olcOverlay={0}rwm,olcDatabase={-1}frontend,cn=config: slaptest: bad configuration file! dn: olcOverlay={0}rwm objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: {0}rwm olcRwmTFSupport: false olcRwmNormalizeMapped: FALSE structuralObjectClass: olcRwmConfig olcRwmRewrite: {0}rwm-rewriteEngine "on" olcRwmRewrite: {1}rwm-rewriteMap "ldap" "attr2dn" "ldap://localhost/o=abc.org?dn?sub" olcRwmRewrite: {2}rwm-rewriteContext "bindDN" olcRwmRewrite: {3}rwm-rewriteRule "^eduPersonPrincipalName=[^,]+@[^,]+$" "${ attr2dn($0)}" ":@I" Does anyone have a hint what's going wrong? Thanks, Christian

3 2

avoid modifying /etc/sasl2/slapd.conf
by Michael Ströder 17 Jun '21

17 Jun '21

HI! Some automated tests of my Python module check SASL bind with various mechs. For this to work I normally have to add those SASL mechs to /etc/sasl2/slapd.conf. But this fails in the openSUSE build system with "permission denied". Is there a possibility to override SASL mechs used by slapd with an env var or similar? Ciao, Michael.

3 4

pw-totp
by Stefan Kania 07 Jun '21

07 Jun '21

Hello, I try to set up TOTP1 and TOTP1ANDPW as passworthash. I use Debian 10 with Kernel 5.9 from the backports. As OpenLDAP I use 2.5.5. I set up everything via Ansible. My configure-options are: ------------- ./configure --with-cyrus-sasl --with-tls=openssl --enable-overlays=mod --enable-backends=mod --disable-perl --disable-ndb --enable-crypt --enable-modules --enable-dynamic --enable-syslog --enable-debug --enable-local --enable-spasswd --disable-sq l --prefix=/opt/openldap-current ------------- In addition I build: ------------ /opt/openldap-current/contrib/slapd-modules/passwd/sha2 /opt/openldap-current/contrib/slapd-modules/passwd/pbkdf2 /opt/openldap-current/contrib/slapd-modules/passwd/totp/ ------------ "make test" is runnning without any error. The setup is running without any error, here my cn=config: ------------ dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /opt/openldap-current/var/run/slapd.args olcLogLevel: sync olcLogLevel: stats olcLogLevel: stats olcPidFile: /opt/openldap-current/var/run/slapd.pid olcToolThreads: 1 olcTLSCertificateFile: /opt/openldap-current/etc/my_certificates/ldap25-p01-ce rt.pem olcTLSCertificateKeyFile: /opt/openldap-current/etc/my_certificates/ldap25-p01 -key.pem olcTLSCACertificateFile: /opt/openldap-current/etc/my_certificates/cacert.pem olcPasswordHash: {TOTP1} dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /opt/openldap-current/libexec/openldap:/usr/local/libexec/openl dap olcModuleLoad: {0}back_mdb olcModuleLoad: {1}back_monitor olcModuleLoad: {2}pw-totp.la olcModuleLoad: {3}autoca.la ... schema.... dn: olcBackend={0}mdb,cn=config objectClass: olcBackendConfig olcBackend: {0}mdb dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=externa l,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=ex ternal,cn=auth manage by * break olcAccess: {1}to dn="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read olcSizeLimit: 500 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=externa l,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=ex ternal,cn=auth manage by dn.exact=uid=ldap-admin,ou=users,dc=example,dc=net write by * break olcRootDN: cn=admin,cn=config olcRootPW: dn: olcDatabase={1}monitor,cn=config objectClass: olcDatabaseConfig olcDatabase: {1}monitor olcAccess: {0}to dn.subtree="cn=monitor" by dn.exact=cn=admin,cn=config read by dn.exact=cn=admin,dc=example,dc=net read dn: olcDatabase={2}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcmdbConfig olcDatabase: {2}mdb olcDbDirectory: /opt/openldap-current/var/lib/ldap olcSuffix: dc=example,dc=net olcAccess: {0} to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=extern al,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=e xternal,cn=auth manage by dn.exact=uid=ldap-admin,ou=users,dc=example,dc=net write by dn.exact=uid=repl-user,ou=users,dc=example,dc=net read by * break olcAccess: {1}to dn.exact="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read olcAccess: {3} to attrs=userPassword by anonymous auth by self write by * non e olcLimits: {0} dn.exact="uid=repl-user,ou=users,dc=example,dc=net" time=unl imited size=unlimited olcLimits: {1} dn.exact="uid=ldap-admin,ou=users,dc=example,dc=net" time=unlim ited size=unlimited olcRootDN: cn=admin,dc=example,dc=net olcRootPW: {SSHA}D6GKFhWChzpTnTmsxLVqJqTnFm+8fr3K olcSizeLimit: unlimited olcTimeLimit: unlimited olcDbCheckpoint: 512 30 olcDbIndex: default eq olcDbIndex: objectClass olcDbIndex: entryUUID olcDbIndex: entryCSN olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: mail pres,eq,sub olcDbIndex: sn pres,eq,sub olcDbIndex: description pres,eq,sub olcDbIndex: title pres,eq,sub olcDbIndex: givenName pres,eq,sub olcDbMaxSize: 85899345920 dn: olcOverlay={0}totp,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig olcOverlay: {0}totp dn: olcOverlay={1}autoca,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcAutoCAConfig olcOverlay: {1}autoca olcAutoCAuserKeybits: 4096 olcAutoCAserverKeybits: 4096 olcAutoCAKeybits: 4096 ------------ After a few minutes or if I restart slapd I get the following error-message: --------------------- Jun 05 15:24:52 ldap25-p01 slapd[16210]: @(#) $OpenLDAP: slapd 2.5.5 (Jun 5 2021 14:07:21) $ root@ldap25-p01:/opt/openldap-2.5.5/servers/slapd Jun 05 15:24:52 ldap25-p01 slapd[16210]: olcPasswordHash: value #0: <olcPasswordHash> scheme not available ({TOTP1}) Jun 05 15:24:52 ldap25-p01 slapd[16210]: olcPasswordHash: value #0: <olcPasswordHash> no valid hashes found Jun 05 15:24:52 ldap25-p01 slapd[16210]: config error processing cn=config: <olcPasswordHash> no valid hashes found --------------------- I used the documentation from symas for configuring TOTP. What's wrong and why is slapd starting after configuration but chrashes when I restart slapd? Stefan

4 17

2.57 to 2.58 update no structural objectClass in configuration table
by Lists Nethead 07 Jun '21

07 Jun '21

Hi all, After 2.57 to 2.58 update, slapd refuses to start. OS is FreeBSD 12, slapd built from ports. No clue what is missing, the system ran for two years without a clitch during updates. Thanks! 60bde84c ldif_read_file: read entry file: "/usr/local/etc/openldap/slapd.d/cn=config/olcDatabase={1}mdb/olcOverlay={0}syncprov.ldif" 60bde84c => str2entry: "# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 97cb42e9 dn: olcOverlay={0}syncprov objectClass: top objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 10 structuralObjectClass: olcSyncProvConfig entryUUID: 8ed9549c-5ee4-1036-9903-fd364e50deb0 creatorsName: cn=config createTimestamp: 20161225115355Z entryCSN: 20161225115355.953738Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20161225115355Z " 60bde84c >>> dnPrettyNormal: <olcOverlay={0}syncprov> => ldap_bv2dn(olcOverlay={0}syncprov,0) <= ldap_bv2dn(olcOverlay={0}syncprov)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcOverlay={0}syncprov)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcOverlay={0}syncprov)=0 60bde84c <<< dnPrettyNormal: <olcOverlay={0}syncprov>, <olcOverlay={0}syncprov> 60bde84c <= str2entry: str2ad(olcSpCheckpoint): attribute type undefined 60bde84c UNKNOWN attributeDescription "OLCSPCHECKPOINT" inserted. 60bde84c >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 60bde84c <<< dnNormalize: <cn=config> 60bde84c >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 60bde84c <<< dnNormalize: <cn=config> 60bde84c <= str2entry(olcOverlay={0}syncprov) -> 0x8013a5e48 60bde84c => test_filter 60bde84c PRESENT 60bde84c => access_allowed: search access to "olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config" "objectClass" requested 60bde84c <= root access granted 60bde84c => access_allowed: search access granted by manage(=mwrscxd) 60bde84c <= test_filter 6 60bde84c : config_add_internal: DN="olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config" no structural objectClass in configuration table 60bde84c config error processing olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config: 60bde84c send_ldap_result: conn=-1 op=0 p=0 60bde84c send_ldap_result: err=65 matched="" text="" 60bde84c slapd destroy: freeing system resources. 60bde84c syncinfo_free: rid=131 60bde84c slapd stopped.

2 2

unable to add DB DIT , getting value #0 invalid per syntax error in alpine Linux.
by govid 06 Jun '21

06 Jun '21

unable to add DB DIT , getting value #0 invalid per syntax error command used : ldapadd -x -D 'cn=config' -w secret -f create_sns_db.ldif below is the content of "create_sns_db.ldif" file dn: olcDatabase=mdb,cn=config objectClass: olcMdbConfig olcDatabase: mdb olcDbMaxSize: 1073741824 olcSuffix: dc=smartsan olcDbDirectory: /usr/local/var/openldap-data/sns_db olcRootDN: cn=admin,dc=smartsan olcRootPW: secret2 olcDbIndex: objectClass eq below is the debug output for the ldapadd command used: #ldapadd -x -D 'cn=config' -w secret -f create_sns_db.ldif -d 255 ldap_create ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost:389 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying ::1 389 ldap_pvt_connect: fd: 4 tm: -1 async: 0 attempting to connect: connect success ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x7f1aa9d18010 ptr=0x7f1aa9d18010 end=0x7f1aa9d1802d len=29 0000: 30 1b 02 01 01 60 16 02 01 03 04 09 63 6e 3d 63 0....`......cn=c 0010: 6f 6e 66 69 67 80 06 73 65 63 72 65 74 onfig..secret ber_scanf fmt ({i) ber: ber_dump: buf=0x7f1aa9d18010 ptr=0x7f1aa9d18015 end=0x7f1aa9d1802d len=24 0000: 60 16 02 01 03 04 09 63 6e 3d 63 6f 6e 66 69 67 `......cn=config 0010: 80 06 73 65 63 72 65 74 ..secret ber_flush2: 29 bytes to sd 4 0000: 30 1b 02 01 01 60 16 02 01 03 04 09 63 6e 3d 63 0....`......cn=c 0010: 6f 6e 66 69 67 80 06 73 65 63 72 65 74 onfig..secret ldap_write: want=29, written=29 0000: 30 1b 02 01 01 60 16 02 01 03 04 09 63 6e 3d 63 0....`......cn=c 0010: 6f 6e 66 69 67 80 06 73 65 63 72 65 74 onfig..secret ldap_result ld 0x7f1aaa121dc0 msgid 1 wait4msg ld 0x7f1aaa121dc0 msgid 1 (infinite timeout) wait4msg continue ld 0x7f1aaa121dc0 msgid 1 all 1 ** ld 0x7f1aaa121dc0 Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Tue May 25 05:42:41 2021 ** ld 0x7f1aaa121dc0 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x7f1aaa121dc0 request count 1 (abandoned 0) ** ld 0x7f1aaa121dc0 Response Queue: Empty ld 0x7f1aaa121dc0 response count 0 ldap_chkResponseList ld 0x7f1aaa121dc0 msgid 1 all 1 ldap_chkResponseList returns ld 0x7f1aaa121dc0 NULL ldap_int_select read1msg: ld 0x7f1aaa121dc0 msgid 1 all 1 ber_get_next ldap_read: want=8, got=8 0000: 30 0c 02 01 01 61 07 0a 0....a.. ldap_read: want=6, got=6 0000: 01 00 04 00 04 00 ...... ber_get_next: tag 0x30 len 12 contents: ber_dump: buf=0x7f1aaa048b10 ptr=0x7f1aaa048b10 end=0x7f1aaa048b1c len=12 0000: 02 01 01 61 07 0a 01 00 04 00 04 00 ...a........ read1msg: ld 0x7f1aaa121dc0 msgid 1 message type bind ber_scanf fmt ({eAA) ber: ber_dump: buf=0x7f1aaa048b10 ptr=0x7f1aaa048b13 end=0x7f1aaa048b1c len=9 0000: 61 07 0a 01 00 04 00 04 00 a........ read1msg: ld 0x7f1aaa121dc0 0 new referrals read1msg: mark request completed, ld 0x7f1aaa121dc0 msgid 1 request done: ld 0x7f1aaa121dc0 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_dump: buf=0x7f1aaa048b10 ptr=0x7f1aaa048b13 end=0x7f1aaa048b1c len=9 0000: 61 07 0a 01 00 04 00 04 00 a........ ber_scanf fmt (}) ber: ber_dump: buf=0x7f1aaa048b10 ptr=0x7f1aaa048b1c end=0x7f1aaa048b1c len=0 ldap_msgfree adding new entry "olcDatabase=mdb,cn=config" ldap_add_ext ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x7f1aa9d18020 ptr=0x7f1aa9d18020 end=0x7f1aa9d18148 len=296 0000: 30 82 01 24 02 01 02 68 82 01 1d 04 19 6f 6c 63 0..$...h.....olc 0010: 44 61 74 61 62 61 73 65 3d 6d 64 62 2c 63 6e 3d Database=mdb,cn= 0020: 63 6f 6e 66 69 67 30 81 ff 30 1d 04 0b 6f 62 6a config0..0...obj 0030: 65 63 74 43 6c 61 73 73 31 0e 04 0c 6f 6c 63 4d ectClass1...olcM 0040: 64 62 43 6f 6e 66 69 67 30 14 04 0b 6f 6c 63 44 dbConfig0...olcD 0050: 61 74 61 62 61 73 65 31 05 04 03 6d 64 62 30 1c atabase1...mdb0. 0060: 04 0c 6f 6c 63 44 62 4d 61 78 53 69 7a 65 31 0c ..olcDbMaxSize1. 0070: 04 0a 31 30 37 33 37 34 31 38 32 34 30 1a 04 09 ..10737418240... 0080: 6f 6c 63 53 75 66 66 69 78 31 0d 04 0b 64 63 3d olcSuffix1...dc= 0090: 73 6d 61 72 74 73 61 6e 30 31 04 0e 6f 6c 63 44 smartsan01..olcD 00a0: 62 44 69 72 65 63 74 6f 72 79 31 1f 04 1d 2f 76 bDirectory1.../v 00b0: 61 72 2f 6c 69 62 2f 6f 70 65 6e 6c 64 61 70 2d ar/lib/openldap- 00c0: 64 61 74 61 2f 73 6e 73 5f 64 62 30 23 04 09 6f data/sns_db0#..o 00d0: 6c 63 52 6f 6f 74 44 4e 31 16 04 14 63 6e 3d 61 lcRootDN1...cn=a 00e0: 64 6d 69 6e 2c 64 63 3d 73 6d 61 72 74 73 61 6e dmin,dc=smartsan 00f0: 30 16 04 09 6f 6c 63 52 6f 6f 74 50 57 31 09 04 0...olcRootPW1.. 0100: 07 73 65 63 72 65 74 32 30 1e 04 0a 6f 6c 63 44 .secret20...olcD 0110: 62 49 6e 64 65 78 31 10 04 0e 6f 62 6a 65 63 74 bIndex1...object 0120: 43 6c 61 73 73 20 65 71 Class eq ber_scanf fmt ({) ber: ber_dump: buf=0x7f1aa9d18020 ptr=0x7f1aa9d18027 end=0x7f1aa9d18148 len=289 0000: 68 82 01 1d 04 19 6f 6c 63 44 61 74 61 62 61 73 h.....olcDatabas 0010: 65 3d 6d 64 62 2c 63 6e 3d 63 6f 6e 66 69 67 30 e=mdb,cn=config0 0020: 81 ff 30 1d 04 0b 6f 62 6a 65 63 74 43 6c 61 73 ..0...objectClas 0030: 73 31 0e 04 0c 6f 6c 63 4d 64 62 43 6f 6e 66 69 s1...olcMdbConfi 0040: 67 30 14 04 0b 6f 6c 63 44 61 74 61 62 61 73 65 g0...olcDatabase 0050: 31 05 04 03 6d 64 62 30 1c 04 0c 6f 6c 63 44 62 1...mdb0...olcDb 0060: 4d 61 78 53 69 7a 65 31 0c 04 0a 31 30 37 33 37 MaxSize1...10737 0070: 34 31 38 32 34 30 1a 04 09 6f 6c 63 53 75 66 66 418240...olcSuff 0080: 69 78 31 0d 04 0b 64 63 3d 73 6d 61 72 74 73 61 ix1...dc=smartsa 0090: 6e 30 31 04 0e 6f 6c 63 44 62 44 69 72 65 63 74 n01..olcDbDirect 00a0: 6f 72 79 31 1f 04 1d 2f 76 61 72 2f 6c 69 62 2f ory1.../var/lib/ 00b0: 6f 70 65 6e 6c 64 61 70 2d 64 61 74 61 2f 73 6e openldap-data/sn 00c0: 73 5f 64 62 30 23 04 09 6f 6c 63 52 6f 6f 74 44 s_db0#..olcRootD 00d0: 4e 31 16 04 14 63 6e 3d 61 64 6d 69 6e 2c 64 63 N1...cn=admin,dc 00e0: 3d 73 6d 61 72 74 73 61 6e 30 16 04 09 6f 6c 63 =smartsan0...olc 00f0: 52 6f 6f 74 50 57 31 09 04 07 73 65 63 72 65 74 RootPW1...secret 0100: 32 30 1e 04 0a 6f 6c 63 44 62 49 6e 64 65 78 31 20...olcDbIndex1 0110: 10 04 0e 6f 62 6a 65 63 74 43 6c 61 73 73 20 65 ...objectClass e 0120: 71 q ber_flush2: 296 bytes to sd 4 0000: 30 82 01 24 02 01 02 68 82 01 1d 04 19 6f 6c 63 0..$...h.....olc 0010: 44 61 74 61 62 61 73 65 3d 6d 64 62 2c 63 6e 3d Database=mdb,cn= 0020: 63 6f 6e 66 69 67 30 81 ff 30 1d 04 0b 6f 62 6a config0..0...obj 0030: 65 63 74 43 6c 61 73 73 31 0e 04 0c 6f 6c 63 4d ectClass1...olcM 0040: 64 62 43 6f 6e 66 69 67 30 14 04 0b 6f 6c 63 44 dbConfig0...olcD 0050: 61 74 61 62 61 73 65 31 05 04 03 6d 64 62 30 1c atabase1...mdb0. 0060: 04 0c 6f 6c 63 44 62 4d 61 78 53 69 7a 65 31 0c ..olcDbMaxSize1. 0070: 04 0a 31 30 37 33 37 34 31 38 32 34 30 1a 04 09 ..10737418240... 0080: 6f 6c 63 53 75 66 66 69 78 31 0d 04 0b 64 63 3d olcSuffix1...dc= 0090: 73 6d 61 72 74 73 61 6e 30 31 04 0e 6f 6c 63 44 smartsan01..olcD 00a0: 62 44 69 72 65 63 74 6f 72 79 31 1f 04 1d 2f 76 bDirectory1.../v 00b0: 61 72 2f 6c 69 62 2f 6f 70 65 6e 6c 64 61 70 2d ar/lib/openldap- 00c0: 64 61 74 61 2f 73 6e 73 5f 64 62 30 23 04 09 6f data/sns_db0#..o 00d0: 6c 63 52 6f 6f 74 44 4e 31 16 04 14 63 6e 3d 61 lcRootDN1...cn=a 00e0: 64 6d 69 6e 2c 64 63 3d 73 6d 61 72 74 73 61 6e dmin,dc=smartsan 00f0: 30 16 04 09 6f 6c 63 52 6f 6f 74 50 57 31 09 04 0...olcRootPW1.. 0100: 07 73 65 63 72 65 74 32 30 1e 04 0a 6f 6c 63 44 .secret20...olcD 0110: 62 49 6e 64 65 78 31 10 04 0e 6f 62 6a 65 63 74 bIndex1...object 0120: 43 6c 61 73 73 20 65 71 Class eq ldap_write: want=296, written=296 0000: 30 82 01 24 02 01 02 68 82 01 1d 04 19 6f 6c 63 0..$...h.....olc 0010: 44 61 74 61 62 61 73 65 3d 6d 64 62 2c 63 6e 3d Database=mdb,cn= 0020: 63 6f 6e 66 69 67 30 81 ff 30 1d 04 0b 6f 62 6a config0..0...obj 0030: 65 63 74 43 6c 61 73 73 31 0e 04 0c 6f 6c 63 4d ectClass1...olcM 0040: 64 62 43 6f 6e 66 69 67 30 14 04 0b 6f 6c 63 44 dbConfig0...olcD 0050: 61 74 61 62 61 73 65 31 05 04 03 6d 64 62 30 1c atabase1...mdb0. 0060: 04 0c 6f 6c 63 44 62 4d 61 78 53 69 7a 65 31 0c ..olcDbMaxSize1. 0070: 04 0a 31 30 37 33 37 34 31 38 32 34 30 1a 04 09 ..10737418240... 0080: 6f 6c 63 53 75 66 66 69 78 31 0d 04 0b 64 63 3d olcSuffix1...dc= 0090: 73 6d 61 72 74 73 61 6e 30 31 04 0e 6f 6c 63 44 smartsan01..olcD 00a0: 62 44 69 72 65 63 74 6f 72 79 31 1f 04 1d 2f 76 bDirectory1.../v 00b0: 61 72 2f 6c 69 62 2f 6f 70 65 6e 6c 64 61 70 2d ar/lib/openldap- 00c0: 64 61 74 61 2f 73 6e 73 5f 64 62 30 23 04 09 6f data/sns_db0#..o 00d0: 6c 63 52 6f 6f 74 44 4e 31 16 04 14 63 6e 3d 61 lcRootDN1...cn=a 00e0: 64 6d 69 6e 2c 64 63 3d 73 6d 61 72 74 73 61 6e dmin,dc=smartsan 00f0: 30 16 04 09 6f 6c 63 52 6f 6f 74 50 57 31 09 04 0...olcRootPW1.. 0100: 07 73 65 63 72 65 74 32 30 1e 04 0a 6f 6c 63 44 .secret20...olcD 0110: 62 49 6e 64 65 78 31 10 04 0e 6f 62 6a 65 63 74 bIndex1...object 0120: 43 6c 61 73 73 20 65 71 Class eq ldap_result ld 0x7f1aaa121dc0 msgid 2 wait4msg ld 0x7f1aaa121dc0 msgid 2 (timeout 100000 usec) wait4msg continue ld 0x7f1aaa121dc0 msgid 2 all 1 ** ld 0x7f1aaa121dc0 Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Tue May 25 05:42:41 2021 ** ld 0x7f1aaa121dc0 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x7f1aaa121dc0 request count 1 (abandoned 0) ** ld 0x7f1aaa121dc0 Response Queue: Empty ld 0x7f1aaa121dc0 response count 0 ldap_chkResponseList ld 0x7f1aaa121dc0 msgid 2 all 1 ldap_chkResponseList returns ld 0x7f1aaa121dc0 NULL ldap_int_select read1msg: ld 0x7f1aaa121dc0 msgid 2 all 1 ber_get_next ldap_read: want=8, got=8 0000: 30 34 02 01 02 69 2f 0a 04...i/. ldap_read: want=46, got=46 0000: 01 15 04 00 04 28 6f 62 6a 65 63 74 43 6c 61 73 .....(objectClas 0010: 73 3a 20 76 61 6c 75 65 20 23 30 20 69 6e 76 61 s: value #0 inva 0020: 6c 69 64 20 70 65 72 20 73 79 6e 74 61 78 lid per syntax ber_get_next: tag 0x30 len 52 contents: ber_dump: buf=0x565118724fb0 ptr=0x565118724fb0 end=0x565118724fe4 len=52 0000: 02 01 02 69 2f 0a 01 15 04 00 04 28 6f 62 6a 65 ...i/......(obje 0010: 63 74 43 6c 61 73 73 3a 20 76 61 6c 75 65 20 23 ctClass: value # 0020: 30 20 69 6e 76 61 6c 69 64 20 70 65 72 20 73 79 0 invalid per sy 0030: 6e 74 61 78 ntax read1msg: ld 0x7f1aaa121dc0 msgid 2 message type add ber_scanf fmt ({eAA) ber: ber_dump: buf=0x565118724fb0 ptr=0x565118724fb3 end=0x565118724fe4 len=49 0000: 69 2f 0a 01 15 04 00 04 28 6f 62 6a 65 63 74 43 i/......(objectC 0010: 6c 61 73 73 3a 20 76 61 6c 75 65 20 23 30 20 69 lass: value #0 i 0020: 6e 76 61 6c 69 64 20 70 65 72 20 73 79 6e 74 61 nvalid per synta 0030: 78 x read1msg: ld 0x7f1aaa121dc0 0 new referrals read1msg: mark request completed, ld 0x7f1aaa121dc0 msgid 2 request done: ld 0x7f1aaa121dc0 msgid 2 res_errno: 21, res_error: <objectClass: value #0 invalid per syntax>, res_matched: <> ldap_free_request (origid 2, msgid 2) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_dump: buf=0x565118724fb0 ptr=0x565118724fb3 end=0x565118724fe4 len=49 0000: 69 2f 0a 01 15 04 00 04 28 6f 62 6a 65 63 74 43 i/......(objectC 0010: 6c 61 73 73 3a 20 76 61 6c 75 65 20 23 30 20 69 lass: value #0 i 0020: 6e 76 61 6c 69 64 20 70 65 72 20 73 79 6e 74 61 nvalid per synta 0030: 78 x ber_scanf fmt (}) ber: ber_dump: buf=0x565118724fb0 ptr=0x565118724fe4 end=0x565118724fe4 len=0 ldap_msgfree ldap_err2string ldap_add: Invalid syntax (21) additional info: objectClass: value #0 invalid per syntax ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 4 0000: 30 05 02 01 03 42 00 0....B. ldap_write: want=7, written=7 0000: 30 05 02 01 03 42 00 0....B. ldap_free_connection: actually freed Note: i have manually typed the contents of the ldif file to make sure no extra characters are there.

2 10

Symas OpenLDAP for Linux 2.4.59 Released
by Quanah Gibson-Mount 04 Jun '21

04 Jun '21

The latest version of Symas OpenLDAP for Linux is now available for RHEL7, RHEL8, Ubuntu18 LTS, and Ubuntu 20 LTS. <https://repo.symas.com/sofl/> for installation instructions. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

OpenLDAP 2.4.x branch support
by Norm Green 04 Jun '21

04 Jun '21

Do we have some idea of how long the 2.4.x branch will be maintained and supported? The roadmap page appears to be out of date (https://openldap.org/software/roadmap.html). thanks, Norm Green

2 1

openSUSE/SLE packages for 2.5.5 (was: OpenLDAP 2.5.5 available)
by Michael Ströder 04 Jun '21

04 Jun '21

On 6/4/21 12:32 AM, project(a)openldap.org wrote: > OpenLDAP 2.5.5 is now available for download as detailed on our download page: > > https://www.openldap.org/software/download/ As usual you can find packages for several openSUSE/SLE versions in this OBS project: https://build.opensuse.org/project/show/home:stroeder:openldap25 Notes: - The packages are still considered experimental and not tested in production. This is not a statement about OpenLDAP 2.5.5 itself. - This is my private work not related to the OpenLDAP nor the openSUSE projects => blame me if something looks wrong with the packaging. - If unsure install openldap-ms, not openldap2. This uses a separate prefix /opt/openldap-ms. Ciao, Michael.

1 0

openSUSE/SLE packages for 2.4.59 (was: OpenLDAP 2.4.59 available)
by Michael Ströder 04 Jun '21

04 Jun '21

On 6/4/21 12:28 AM, project(a)openldap.org wrote: > OpenLDAP 2.4.59 is now available for download as detailed on our download page: > > https://www.openldap.org/software/download/ As usual you can find packages for several openSUSE/SLE versions here: https://build.opensuse.org/package/show/network:ldap/openldap2 OpenLDAP 2.4.59 will probably reach regular openSUSE Tumbleweed repos during the next days. Ciao, Michael.

1 0

LTB packages for OpenLDAP 2.4.59 [was: OpenLDAP 2.4.59 available]
by Clément OUDOT 04 Jun '21

04 Jun '21

Hello, LTB packages for OpenLDAP 2.4.59 are now availble (Debian/Ubuntu/CentOS/RHEL). More information on https://projects.ow2.org/view/ldaptoolbox/ltb-openldap-2-4-59-packages-rele… -- Clément Oudot | Identity Solutions Manager clement.oudot(a)worteks.com Worteks | https://www.worteks.com

1 0

Re: hdb to mdb
by Dave Macias 04 Jun '21

04 Jun '21

Thank you very much for the kind help! Much appreciated Best, Dave On Jun 3, 2021, 5:51 PM -0400, Quanah Gibson-Mount <quanah(a)symas.com>, wrote: > > > --On Thursday, June 3, 2021 6:02 PM -0400 Dave Macias <davama(a)gmail.com> > wrote: > > > > > > > So therefore i dont need to worry about back_mdb since it's already > > loaded. > > Yes? > > Right. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com>

1 1

Re: hdb to mdb
by Dave Macias 03 Jun '21

03 Jun '21

So therefore i dont need to worry about back_mdb since it’s already loaded. Yes? On Jun 3, 2021, 4:50 PM -0400, Quanah Gibson-Mount <quanah(a)symas.com>, wrote: > > > --On Thursday, June 3, 2021 5:43 PM -0400 Dave Macias <davama(a)gmail.com> > wrote: > > > > > > slapd -VVV > > @(#) $OpenLDAP: slapd 2.4.58 (Mar 16 2021 19:13:56) $ > > build@c7rpm:/home/build/git/rheldap/RHEL7_x86_64/BUILD/symas-openldap-2.4 > > .58/openldap-2.4.58/servers/slapd > > > > Included static backends: > > config > > ldif > > monitor > > bdb > > hdb > > mdb > > > > > > > > Not sure what to look for... "mdb" is that is? > > Yes, that indicates mdb was built statically. > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com>

2 1

hdb to mdb
by Dave Macias 03 Jun '21

03 Jun '21

Hello, Saw this link in a recent mail to this list. https://www.openldap.org/doc/admin25/appendix-upgrading.html Looks like hdb would no longer be supported. I googled a bit to see what it would take to move over to mdb and stumbled on this post. https://www.mail-archive.com/openldap-technical@openldap.org/msg25484.html My question is: Is it really that easy? Just replace all my instances of hdb or Hdb with mdp or Mdb respectively? Additionally add “olcDbMaxSize” to my top lavel “olcDatabase={2}hdb,cn=config” ? Then reimport ? Below is a much redacted slapcat of my config. Any input is much appreciated. Thank you, Dave dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1 structuralObjectClass: olcGlobal creatorsName: cn=config modifiersName: cn=config ... ... dn: olcDatabase={2}hdb,cn=config objectClass: olcHdbConfig olcDatabase: {2}hdb structuralObjectClass: olcHdbConfig ... dn: olcOverlay={0}auditlog,olcDatabase={2}hdb,cn=config ... dn: olcOverlay={1}ppolicy,olcDatabase={2}hdb,cn=config ... dn: olcOverlay={2}syncprov,olcDatabase={2}hdb,cn=config ...

3 4

Re: hdb to mdb
by Dave Macias 03 Jun '21

03 Jun '21

Thank you for the reply > > My question is: > > Is it really that easy? > > yes. Make sure that you have back_mdb moduleloaded as well if it's built > as a module. You do have to export your DB via slapcat and then reimport > with slapadd as well. > I dont have back_mdb built as a module... so i'm assuming I dont need to worry about it, yes?? Yes, slapcat/add POST hdb > mdb conversion. Thanks!

1 0

Question regarding dnattr for auth
by cyril.stoll＠uzh.ch 03 Jun '21

03 Jun '21

2 2

Replication between 2.4.x 2.5.x versions
by Nick Milas 02 Jun '21

02 Jun '21

Hello, We are running a (small) number of OpenLDAP instances with v2.4.58. There is a single master and 4 syncrepl consumers (all on CentOS 7 boxes), all running with back-mdb. We are planning our migration from 2.4 to 2.5.x My question: Would it be OK if we migrate our master server to 2.5.latest, and leave consumers to 2.4.58 for a while? Would any implications be expected? Or it is strongly suggested to shutdown all the servers, migrate to 2.5 in parallel and then restart? (Obviously, the latter approach is more demanding in admin and maintenance planning.) Finally: Is there a script or other way to check possible config incompatibilities with 2.5.x (in order to avoid surprises)? (Note: Our master uses cn=config, while consumers still use slapd.conf.) I will appreciate your advice. Thanks, Nick.

3 2

LMDB MAP_LOCK flag on readers to minimize major page faults
by Vitaly Zuevsky 31 May '21

31 May '21

Hi MAP_LOCK flag to mmap() on LMDB readers should populate page cache from the file being mapped and preclude those pages from eviction. I was wondering if that was ever tested, especially with frequent writes to the underlying file. And is there a standard way (a compile option) to include that flag without modifying source code directly? I see quite a few major faults with perf stat, and I am looking if they could be avoided. I am new to LMDB and I guess this discussion may have taken place before, if you could point me out to the right place.. Thank you. Vitaly

4 10

RE24 testing call #1 (OpenLDAP 2.4.59)
by Quanah Gibson-Mount 31 May '21

31 May '21

his is the first testing call for OpenLDAP 2.4.59. Depending on the results, this may be the only testing call. Generally, get the code for RE24: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_4/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.4.59 Engineering Fixed libldap TLSv1.3 cipher suites with OpenSSL 1.1.1 (ITS#9521) Fixed libldap double free of LDAP_OPT_DEFBASE (ITS#9530) Fixed slapd syncrepl handling of add+delete on single value attr (ITS#9295) Fixed slapd-mdb cursor init check (ITS#9526) Fixed slapd-mdb deletion of context entry (ITS#9531) Fixed slapo-pcache locking during expiration (ITS#9529) Contrib Fixed slapo-autogroup to not thrash thead context (ITS#9494) Documentation ldap_modify(3) - Delete non-existent mod_next parameter (ITS#9559) Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

5 7

Configure autoca in slapd.d
by Stefan Kania 31 May '21

31 May '21

Hallo, I try to get autoca running using the configuration via slapd.d. With slapd.conf it'S working with this configuration: ------- overlay autoca caKeybits 4096 userKeybits 4096 serverKeybits 4096 ------- When I try to configure it with the following settings: --------- dn: olcOverlay={1}autoca,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig olcserverKeybits: 4096 olccaKeybits: 4096 olcuserKeybits: 4096 --------- I'll getting: ------------- additional info: olcserverKeybits: attribute type undefined ------------- If I try to configure autoca with the default values, it works. I use OpenLDAP 2.5.4 on a Debian10 Is there any documentation, more then the manpage? Stefan

2 4

Re: RE25 testing call #1 (OpenLDAP 2.5.5)
by Nick Folino 29 May '21

29 May '21

Make test and make its successful on Fedora 34. Nick On Fri, May 28, 2021 at 5:39 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > This is the first testing call for OpenLDAP 2.5.55. Depending on the > results, this may be the only testing call. > > Generally, get the code for RE25: > > < > https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o… > > > > Extract, configure, and build. > > Execute the test suite (via make test) after it is built. Optionally, cd > tests && make its to run through the regression suite. > > Thanks! > > OpenLDAP 2.5.5 Engineering > Added libldap LDAP_OPT_TCP_USER_TIMEOUT support (ITS#9502) > Added lloadd tcp-user-timeout support (ITS#9502) > Added slapd-asyncmeta tcp-user-timeout support (ITS#9502) > Added slapd-ldap tcp-user-timeout support (ITS#9502) > Added slapd-meta tcp-user-timeout support (ITS#9502) > Fixed incorrect control OIDs for AuthZ Identity (ITS#9542) > Fixed libldap typo in util-int.c (ITS#9541) > Fixed libldap double free of LDAP_OPT_DEFBASE (ITS#9530) > Fixed libldap better TLS1.3 cipher suite handling (ITS#9521, > ITS#9546) > Fixed lloadd multiple issues (ITS#8747) > Fixed slapd slap_op_time to avoid duplicates across restarts > (ITS#9537) > Fixed slapd typo in daemon.c (ITS#9541) > Fixed slapd slapi compilation (ITS#9544) > Fixed slapd to handle empty DN in extended filters (ITS#9551) > Fixed slapd syncrepl searches with empty base (ITS#6467) > Fixed slapd syncrepl refresh on startup (ITS#9324, ITS#9534) > Fixed slapd-asyncmeta quarantine handling (ITS#8721) > Fixed slapd-asyncmeta to have a default operations timeout > (ITS#9555) > Fixed slapd-ldap quarantine handling (ITS#8721) > Fixed slapd-mdb deletion of context entry (ITS#9531) > Fixed slapd-meta quarantine handling (ITS#8721) > Fixed slapo-accesslog to record reqNewDN for modRDN ops (ITS#9552) > Fixed slapo-pcache locking during expiration (ITS#9529) > Fixed slappw-argon2 module installation (ITS#9548) > Contrib > Update ldapc++/ldaptcl to use configure.ac (ITS#9554) > Documentation > ldap_first_attribute(3) - Document ldap_get_attribute_ber > (ITS#8820) > ldap_modify(3) - Delete non-existent mod_next parameter (ITS#9559) > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

RE25 testing call #1 (OpenLDAP 2.5.5)
by Quanah Gibson-Mount 29 May '21

29 May '21

This is the first testing call for OpenLDAP 2.5.55. Depending on the results, this may be the only testing call. Generally, get the code for RE25: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.5.5 Engineering Added libldap LDAP_OPT_TCP_USER_TIMEOUT support (ITS#9502) Added lloadd tcp-user-timeout support (ITS#9502) Added slapd-asyncmeta tcp-user-timeout support (ITS#9502) Added slapd-ldap tcp-user-timeout support (ITS#9502) Added slapd-meta tcp-user-timeout support (ITS#9502) Fixed incorrect control OIDs for AuthZ Identity (ITS#9542) Fixed libldap typo in util-int.c (ITS#9541) Fixed libldap double free of LDAP_OPT_DEFBASE (ITS#9530) Fixed libldap better TLS1.3 cipher suite handling (ITS#9521, ITS#9546) Fixed lloadd multiple issues (ITS#8747) Fixed slapd slap_op_time to avoid duplicates across restarts (ITS#9537) Fixed slapd typo in daemon.c (ITS#9541) Fixed slapd slapi compilation (ITS#9544) Fixed slapd to handle empty DN in extended filters (ITS#9551) Fixed slapd syncrepl searches with empty base (ITS#6467) Fixed slapd syncrepl refresh on startup (ITS#9324, ITS#9534) Fixed slapd-asyncmeta quarantine handling (ITS#8721) Fixed slapd-asyncmeta to have a default operations timeout (ITS#9555) Fixed slapd-ldap quarantine handling (ITS#8721) Fixed slapd-mdb deletion of context entry (ITS#9531) Fixed slapd-meta quarantine handling (ITS#8721) Fixed slapo-accesslog to record reqNewDN for modRDN ops (ITS#9552) Fixed slapo-pcache locking during expiration (ITS#9529) Fixed slappw-argon2 module installation (ITS#9548) Contrib Update ldapc++/ldaptcl to use configure.ac (ITS#9554) Documentation ldap_first_attribute(3) - Document ldap_get_attribute_ber (ITS#8820) ldap_modify(3) - Delete non-existent mod_next parameter (ITS#9559) Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Openldap trying to setup mozillaAbPersonAlpha.schema
by bob＠gunas.co.uk 29 May '21

29 May '21

I don't know if this is the best place to ask for help but I can only try please don't shoot me down. I'm new to openldap and find it hard going so any help would great. Trying to setup an Address book to work with Thunderbird. Trying to Include mozillaAbPersonAlpha.schema in to Ldap 2.4.7 on Ubuntu server 20.04.2 The steps I have taken 1) mkdir /tmp/ldapworkingdir 2) cd /tmp/ldapworkingdir/ 3) touch ldap.conf 4) echo "include /etc/ldap/schema/mozillaAbPersonAlpha.schema" > ldap.conf 5) slaptest -f ldap.conf -F . 6) the error message 60b0fc5f /etc/ldap/schema/mozillaAbPersonAlpha.schema: line 148 objectclass: AttributeType not found: "c" slaptest: bad configuration directory! I have tried look for example of how to setup Thunderbird address book but with no look. I do hope someone can help. Thanks Bob H

2 4

radlib.h: No such file or directory - passwd slapd-module
by rguichardspam＠Gmail.com 29 May '21

29 May '21

Hi, while compile passwd slapd-modules, I've got error on Radius compilation. gcc -DOPENLDAP_FD_SETSIZE=4096 -O2 -g -DSLAP_SCHEMA_EXPOSE -g -O2 -I/usr/kerberos/include -I../../../include -I../../../include -I../../../servers/slapd -c radius.c -fPIC -DPIC -o .libs/radius.o radius.c:27:20: fatal error: radlib.h: No such file or directory #include <radlib.h> I've searched which package could provide the radlib file but I didn't found it. Please confirm which package should be used .. or link to the source.. I'm on CentOS

2 1

Using the openldap c api
by matt_hannay1＠yahoo.com.au 27 May '21

27 May '21

We are in the throw of migrating to openldap however we have a problem. we currently have the 2.4 release of the client libraries. I have a problem in the mean time. we have a ldap repository that does not support TLS but only supports the SSL v1.3 standard .....yes I know about the security risks that's why we are migrating. Currently the Old Mozilla C api is in use which I have to replace. From looking at the 2.4 API docs would I be correct in saying the API does not support SSL v1.3 ? Would the Deprecated API calls get me over the line in replacing the mozilla and establishing a SSL connection, Or should I look at going to an older openldap API version? Thanks Matt

1 0

Updating schema in cn=config
by Nick Milas 19 May '21

19 May '21

Hello, We are using PowerDNS with LDAP Backend. At some point the backend schema changed so in order to upgrade we need to change the schema loaded in OpenLDAP. Unfortunately, something seems to be going wrong in the process. What I did: First, I converted the new schema to ldif by creating a dummy conf file: # cat /root/work/dnsdomain2-new.conf include /root/work/core.schema include /root/work/cosine.schema include /root/work/dnsdomain2.schema include /root/work/pdns-domaininfo.schema and then running: # slaptest -f dnsdomain2-new.conf -F dnsdomain2-new.d # slapcat -F dnsdomain2-new.d -bcn=config > dd2new-schema.ldif Then, on the actual config I exported initial config: # slapcat -n0 -F /usr/local/openldap/etc/openldap/slapd.d/ -l /root/work/ldapconf-01.ldif and edited the output (ldapconf-01.ldif) by replacing the whole dnsdomain2 section with the new one (as is in dd2new-schema.ldif file). The initial dnsdomain2 section was {10} so I renumbered the copied schema section from {2} to {10}. In the end of schema definitions section I added pdns-domaininfo definition (copied from dd2new-schema.conf), to which I gave the last number +1, which was {16} (rather than {3}, as it was in the converted file). However, when I try to load this config to a new (empty) slapd.d directory, I get: ========================================================================================== # rm -rf slapd.d # mkdir slapd.d # chown ldap:ldap slapd.d # slapadd -n0 -F ./slapd.d -l /root/work/ldapconf-01.ldif 60a2e22a olcAttributeTypes: value #2 olcAttributeTypes: Unexpected token before SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) AttributeTypeDescription = "(" whsp numericoid whsp ; AttributeType identifier [ "NAME" qdescrs ] ; name used in AttributeType [ "DESC" qdstring ] ; description [ "OBSOLETE" whsp ] [ "SUP" woid ] ; derived from this other ; AttributeType [ "EQUALITY" woid ] ; Matching Rule name [ "ORDERING" woid ] ; Matching Rule name [ "SUBSTR" woid ] ; Matching Rule name [ "SYNTAX" whsp noidlen whsp ] ; see section 4.3 [ "SINGLE-VALUE" whsp ] ; default multi-valued [ "COLLECTIVE" whsp ] ; default not collective [ "NO-USER-MODIFICATION" whsp ]; default user modifiable [ "USAGE" whsp AttributeUsage ]; default userApplications ; userApplications ; directoryOperation ; distributedOperation ; dSAOperation whsp ")" slapadd: could not add entry dn="cn={10}dnsdomain2,cn=schema,cn=config" (line=2256): _############### 76.98% eta none elapsed none spd 1001.2 k/s Closing DB... ========================================================================================== What am I doing wrong in updating the schemas in cn=config? I find the above message difficult to interpret. Note that there are numerous "SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )" statements in the schema definition. I include the new dnsdomain2 section for your reference: ========================================================================================== dn: cn={10}dnsdomain2,cn=schema,cn=config objectClass: olcSchemaConfig cn: {10}dnsdomain2 olcAttributeTypes: {0}( 1.3.6.1.4.1.2428.20.0.0 NAME 'dNSTTL' DESC 'An integ er denoting time to live' EQUALITY integerMatch ORDERING integerOrderingMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) olcAttributeTypes: {1}( 1.3.6.1.4.1.2428.20.0.1 NAME 'dNSClass' DESC 'The cl ass of a resource record' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.14 66.115.121.1.26 ) olcAttributeTypes: {2}( 1.3.6.1.4.1.2428.20.1.11 NAME 'wKSRecord' DESC 'a we ll known service description, RFC 1035' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {3}( 1.3.6.1.4.1.2428.20.1.12 NAME 'pTRRecord' DESC 'doma in name pointer, RFC 1035' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5 SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {4}( 1.3.6.1.4.1.2428.20.1.13 NAME 'hInfoRecord' DESC 'ho st information, RFC 1035' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5S ubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {5}( 1.3.6.1.4.1.2428.20.1.14 NAME 'mInfoRecord' DESC 'ma ilbox or mail list information, RFC 1035' EQUALITY caseIgnoreIA5Match SUBST R caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {6}( 1.3.6.1.4.1.2428.20.1.16 NAME 'tXTRecord' DESC 'text string, RFC 1035' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substrin gsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {7}( 1.3.6.1.4.1.2428.20.1.17 NAME 'rPRecord' DESC 'for R esponsible Person, RFC 1183' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreI A5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {8}( 1.3.6.1.4.1.2428.20.1.18 NAME 'aFSDBRecord' DESC 'fo r AFS Data Base location, RFC 1183' EQUALITY caseIgnoreIA5Match SUBSTR case IgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {9}( 1.3.6.1.4.1.2428.20.1.24 NAME 'SigRecord' DESC 'Sign ature, RFC 2535' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substrings Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {10}( 1.3.6.1.4.1.2428.20.1.25 NAME 'KeyRecord' DESC 'Key , RFC 2535' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {11}( 1.3.6.1.4.1.2428.20.1.27 NAME 'gPosRecord' DESC 'Ge ographical Position, RFC 1712' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnor eIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {12}( 1.3.6.1.4.1.2428.20.1.28 NAME 'aAAARecord' DESC 'IP v6 address, RFC 1886' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Subst ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {13}( 1.3.6.1.4.1.2428.20.1.29 NAME 'LocRecord' DESC 'Loc ation, RFC 1876' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substrings Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {14}( 1.3.6.1.4.1.2428.20.1.30 NAME 'nXTRecord' DESC 'non -existant, RFC 2535' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substr ingsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {15}( 1.3.6.1.4.1.2428.20.1.33 NAME 'sRVRecord' DESC 'ser vice location, RFC 2782' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Su bstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {16}( 1.3.6.1.4.1.2428.20.1.35 NAME 'nAPTRRecord' DESC 'N aming Authority Pointer, RFC 2915' EQUALITY caseIgnoreIA5Match SUBSTR caseI gnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {17}( 1.3.6.1.4.1.2428.20.1.36 NAME 'kXRecord' DESC 'Key Exchange Delegation, RFC 2230' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnor eIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {18}( 1.3.6.1.4.1.2428.20.1.37 NAME 'certRecord' DESC 'ce rtificate, RFC 2538' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substr ingsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {19}( 1.3.6.1.4.1.2428.20.1.38 NAME 'a6Record' DESC 'A6 R ecord Type, RFC 2874' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Subst ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {20}( 1.3.6.1.4.1.2428.20.1.39 NAME 'dNameRecord' DESC 'N on-Terminal DNS Name Redirection, RFC 2672' EQUALITY caseIgnoreIA5Match SUB STR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {21}( 1.3.6.1.4.1.2428.20.1.42 NAME 'aPLRecord' DESC 'Lis ts of Address Prefixes, RFC 3123' EQUALITY caseIgnoreIA5Match SUBSTR caseIg noreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {22}( 1.3.6.1.4.1.2428.20.1.43 NAME 'dSRecord' DESC 'Dele gation Signer, RFC 3658' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Su bstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {23}( 1.3.6.1.4.1.2428.20.1.44 NAME 'sSHFPRecord' DESC 'S SH Key Fingerprint, RFC 4255' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnore IA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {24}( 1.3.6.1.4.1.2428.20.1.45 NAME 'iPSecKeyRecord' DESC 'SSH Key Fingerprint, RFC 4025' EQUALITY caseIgnoreIA5Match SUBSTR caseIgn oreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {25}( 1.3.6.1.4.1.2428.20.1.46 NAME 'rRSIGRecord' DESC 'R RSIG, RFC 3755' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsM atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {26}( 1.3.6.1.4.1.2428.20.1.47 NAME 'nSECRecord' DESC 'NS EC, RFC 3755' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {27}( 1.3.6.1.4.1.2428.20.1.48 NAME 'dNSKeyRecord' DESC ' DNSKEY, RFC 3755' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substring sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {28}( 1.3.6.1.4.1.2428.20.1.49 NAME 'dHCIDRecord' DESC 'D HCID, RFC 4701' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsM atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {29}( 1.3.6.1.4.1.2428.20.1.50 NAME 'nSEC3Record' DESC 'N SEC record version 3, RFC 5155' EQUALITY caseIgnoreIA5Match SUBSTR caseIgno reIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {30}( 1.3.6.1.4.1.2428.20.1.51 NAME 'nSEC3PARAMRecord' DE SC 'NSEC3 parameters, RFC 5155' EQUALITY caseIgnoreIA5Match SUBSTR caseIgno reIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {31}( 1.3.6.1.4.1.2428.20.1.52 NAME 'tLSARecord' DESC 'TL SA certificate association, RFC 6698' EQUALITY caseIgnoreIA5Match SUBSTR ca seIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {32}( 1.3.6.1.4.1.2428.20.1.59 NAME 'cDSRecord' DESC 'Chi ld DS, RFC7344' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsM atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {33}( 1.3.6.1.4.1.2428.20.1.60 NAME 'cDNSKeyRecord' DESC 'DNSKEY(s) the Child wants reflected in DS, RFC7344' EQUALITY caseIgnoreIA5 Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1 .26 ) olcAttributeTypes: {34}( 1.3.6.1.4.1.2428.20.1.61 NAME 'openPGPKeyRecord' DE SC 'OpenPGP Key, RFC7929' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5S ubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {35}( 1.3.6.1.4.1.2428.20.1.64 NAME 'SVCBRecord' DESC 'Se rvice binding, draft-ietf-dnsop-svcb-https-01' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {36}( 1.3.6.1.4.1.2428.20.1.65 NAME 'HTTPSRecord' DESC 'H TTPS service binding, draft-ietf-dnsop-svcb-https-01' EQUALITY caseIgnoreIA 5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121. 1.26 ) olcAttributeTypes: {37}( 1.3.6.1.4.1.2428.20.1.99 NAME 'sPFRecord' DESC 'Sen der Policy Framework, RFC 4408' EQUALITY caseIgnoreIA5Match SUBSTR caseIgno reIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {38}( 1.3.6.1.4.1.2428.20.1.108 NAME 'EUI48Record' DESC ' EUI-48 address, RFC7043' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Su bstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {39}( 1.3.6.1.4.1.2428.20.1.109 NAME 'EUI64Record' DESC ' EUI-64 address, RFC7043' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Su bstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {40}( 1.3.6.1.4.1.2428.20.1.249 NAME 'tKeyRecord' DESC 'T ransaction Key, RFC2930' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Su bstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {41}( 1.3.6.1.4.1.2428.20.1.256 NAME 'uRIRecord' DESC 'UR I, RFC7553' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {42}( 1.3.6.1.4.1.2428.20.1.257 NAME 'cAARecord' DESC 'Ce rtification Authority Restriction, RFC6844' EQUALITY caseIgnoreIA5Match SUB STR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {43}( 1.3.6.1.4.1.2428.20.1.32769 NAME 'dLVRecord' DESC ' DNSSEC Lookaside Validation, RFC4431' EQUALITY caseIgnoreIA5Match SUBSTR ca seIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {44}( 1.3.6.1.4.1.2428.20.1.65226 NAME 'TYPE65226Record' DESC '' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYN TAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {45}( 1.3.6.1.4.1.2428.20.1.65534 NAME 'TYPE65534Record' DESC '' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYN TAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcObjectClasses: {0}( 1.3.6.1.4.1.2428.20.2 NAME 'dNSDomain2' SUP dNSDomain STRUCTURAL MAY ( DNSTTL $ DNSClass $ WKSRecord $ PTRRecord $ HINFORecord $ MINFORecord $ TXTRecord $ RPRecord $ AFSDBRecord $ SIGRecord $ KEYRecord $ GPOSRecord $ AAAARecord $ LOCRecord $ NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $ A6Record $ DNAMERecord $ APLRecord $ DSRecord $ S SHFPRecord $ IPSECKEYRecord $ RRSIGRecord $ NSECRecord $ DNSKEYRecord $ DHC IDRecord $ NSEC3Record $ NSEC3PARAMRecord $ TLSARecord $ CDSRecord $ CDNSKE YRecord $ OPENPGPKEYRecord $ SVCBRecord $ HTTPSRecord $ SPFRecord $ EUI48Re cord $ EUI64Record $ TKEYRecord $ URIRecord $ CAARecord $ DLVRecord $ TYPE6 5226Record $ TYPE65534Record ) ) structuralObjectClass: olcSchemaConfig entryUUID: 15113670-9f95-49b9-a483-b7d7bf2629ec creatorsName: cn=config createTimestamp: 20111017141815Z entryCSN: 20111017141815.387018Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20111017141815Z ========================================================================================== I even tried to keep the original entryUUID, createTimestamp, entryCSN, modifyTimestamp values (just in case), but it did not make a difference. I appreciate your help. (Note that export of the intial config was done on v2.4.56 and import of the modified config was done on a test server with 2.4.58.) If there is any additional info you may require, I will be glad to provide it. Thanks, Nick

4 12

MDB page growth
by Zetan Drableg 10 May '21

10 May '21

openldap 2.4.57 On 4/14 I ran mdb_copy -c to compact the DB and remove free pages. At that point I had 736k pages/2.9G file size. After compact the database is 41k pages and 140M. This solved my ldap request latency problem (seeing 30 second delays in simple queries when ldap updates are happening). 22 days later, we're at 244k pages and auth latency is up to 2 seconds during updates. The database is now 1G. What accounts for MDB free/unused page growth? We make lots of incremental inserts and removals (Add new user, add user to group, remove user from group, remove user). Removal actions seem to trigger the query latency. Why does a large amount of free pages impact single user removals from large groups? mdb_stat -e /opt/slapd/data Environment Info Map address: (nil) Map size: 17179869184 Page size: 4096 Max pages: 4194304 Number of pages used: 244657 Last transaction ID: 58158791 Max readers: 126 Number of readers used: 18 Status of Main DB Tree depth: 1 Branch pages: 0 Leaf pages: 1 Overflow pages: 0 Entries: 22

5 6

How to enable argon2 module
by Francesco Malvezzi 10 May '21

10 May '21

hi everybody, my problem with argon2 is just the casus belli pointing to something I actually didn't understand in the modules setup. My configure options are: /configure --prefix=/opt/openldap --localstatedir=/var/lib/ --enable-crypt --enable-ppolicy --with-cyrus-sasl --with-tls=openssl --enable-modules --enable-mdb=yes --enable-argon2=yes --with-systemd --enable-accesslog everything compiles and builds fine. test #83 passes: >>>>> Starting test083-argon2 for mdb... running defines.sh Starting slapd on TCP/IP port 9011... Using ldapsearch to check that slapd is running... Adding basic structure... Testing ldapwhoami as cn=argon2,dc=example,dc=com... dn:cn=argon2,dc=example,dc=com >>>>> Test succeeded >>>>> test083-argon2 completed OK for mdb after 1 seconds. $ /opt/openldap/sbin/slappasswd -o module-load=/opt/src/openldap-2.5.4/servers/slapd/pwmods/argon2.la -h {ARGON2} -s test {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$n/QsZfaaYWA7pcQmAPrq8A$3FVBbO5zjMzUPRX+YW10yREA7xG4ben2gR08dGoPW1A Without the -o module-load switch slappasswd doesn't recognize the {ARGON2} scheme, but it looked fine to me: I believed I would need to load the module in cn=config with a content like: $ cat ~/ldif/load_argon2_module.ldif dn: cn=module{1} objectClass: olcModuleList cn: module{1} olcModulePath: /opt/openldap/libexec/openldap/ <- argon2.so is not here olcModuleLoad: {0}argon2 structuralObjectClass: olcModuleList but argon2.so is only in the src dir. Of course I didn't understand something very basic, thank you for your time, Francesco

2 1

Maximum length of a value
by Aaron Bennett 07 May '21

07 May '21

Hi, What is the maximum length of an value? Is it defined in the schema, per-value, or is there a global maximum in OpenLDAP? Thanks, Aaron --- Aaron Bennett Manager of Systems Administration Clark University ITS

2 1

Re: Migrating From DSEE7 to OpenLDAP; Base64 Values Fail To Import Using ldapadd
by Felix Schmitt 06 May '21

06 May '21

Hi, The issues might come from the fact that ODSEE has implemented RFC 2307bis - which aimed to improve on the old RFC 2307. As far as I know this never got a real standard - even though some companies adopted it. RFC 2307bis defines some things slightly different. from RFC2307. One of those cases is the gecos field which is a Directory String (SYNTAX 1.3.6.1.4.1.1466.115.121.1.15) and can take UTF-8 character. Have a look here https://docs.ldap.com/specs/draft-howard-rfc2307bis-02.txt Regards Felix -- Felix Schmitt Ingenieur für IT/TK Systemberatung Blumenweg 24 phone: +49 8092 20796 D-85567 Grafing mobile: +49 172 842 99 12 Germany <mailto:Felix-Schmitt@t-online.de> mailto:Felix-Schmitt@t-online.de

4 5

Re: idletimeout setting is not working
by aRaviNd 06 May '21

06 May '21

Yes, It was not using slapd.conf and I was making changes on slapd.conf. It was my mistake. Thanks Quanah On Thu, May 6, 2021 at 8:42 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Thursday, May 6, 2021 1:46 PM +0530 aRaviNd <ambadiaravind(a)gmail.com> > > wrote: > > > > > Hi, > > > > > > Eventhough we have configured idletimeout as 0 in our slapd.conf , every > > 5 mins slapd is closing the connection. > > > > Why the idletimeout setting is not taking effect? > > Did you restart slapd after making the change? Does your system even use > slapd.conf, or is it actually using cn=config? etc. > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Migrating From DSEE7 to OpenLDAP; Base64 Values Fail To Import Using ldapadd
by harklib＠protonmail.com 06 May '21

06 May '21

Hi, I am in the process of migrating away from our ancient Oracle DSEE7 directory servers to OpenLDAP 2.4.44-23.el7_9.x86_64. One problem I'm experiencing when importing entries with attribute values encoded in base64 is: adding new entry "cn=LastName,ou=People,dc=cs,dc=university,dc=edu" ldap_add: Invalid syntax (21) additional info: gecos: value #0 invalid per syntax dn: cn=nis,cn=schema,cn=config objectClass: olcSchemaConfig cn: nis olcAttributeTypes: ( 1.3.6.1.1.1.1.2 NAME 'gecos' DESC 'The GECOS field; the common name' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) In this example, the "gecos" attribute has the first name "Jérémie", e.g., "gecos:: SsOpcsOpbWll". When I decode it using `base64 -d` it decodes just fine. Why can I not import this base64 encoded value, and others, using ldapadd? I'm binding as olcRootDN which has the appropriate permission, manage, as far as I can tell but have also used SASL EXTERNAL--same results. Do I need to decode these values in my LDIF file first? I've scoured the internet and the archives here, so forgive me if I've missed a glaringly obvious thread. Another note, I've used `./dsconf export --no-repl [...]` to avoid the DSEE7 sync-repl operational cruft. I still had some cleaning up to do, but I still don't understand why the base64 values are a hard stop. Thanks in advance, Brian

3 2

idletimeout setting is not working
by aRaviNd 06 May '21

06 May '21

Hi, Eventhough we have configured idletimeout as 0 in our slapd.conf , every 5 mins slapd is closing the connection. May 06 06:54:07 example1 slapd[4919]: conn=10016 fd=731 closed (idletimeout) May 06 06:54:07 example1 slapd[4919]: conn=10017 fd=732 closed (idletimeout) May 06 06:54:07 example1 slapd[4919]: conn=10018 fd=734 closed (idletimeout) May 06 06:54:07 example1 slapd[4919]: conn=10019 fd=735 closed (idletimeout) Why the idletimeout setting is not taking effect? Operating system: Red Hat Enterprise Linux Server release 7.8 (Maipo) Openldap version: openldap-2.4.44-22.el7.x86_64 Regards, Aravind M D

2 1

SyncProv checkpointing
by thomaswilliampritchard＠gmail.com 06 May '21

06 May '21

Hi, Through testing we have discovered restoring from backup is most accurate when we have the syncprov checkpointing at "1 1". Or checkpoint after 1 operation or 1 minute (olcSpCheckpoint: 1 1). Are there any concerns with having this frequent of checkpointing? Thanks, Thomas

3 11

OpenLDAP 2.5.4 WARNING: Could not locate systemd
by Nick Folino 01 May '21

01 May '21

Configuring OpenLDAP 2.5.4 on Fedora 33: $ ./configure --prefix /apps/openldap -q Configuring OpenLDAP 2.5.4-Release ... configure: WARNING: Could not locate systemd configure: WARNING: systemd service notification not supported! This didn't happen with 2.5.2beta, but does with 2.5RC. I missed it during my testing. Any ideas? Nick

2 2

loading slapo-vc does not work
by Michael Ströder 01 May '21

01 May '21

HI! Trying to understand Verify Credentials operation I'd like to initialize slapo-vc but it fails (see simple config below). 608d43ae.18d5fdad 0x7f6e38b66740 slapd.conf: line 13 (overlay vc) 608d43ae.18d623b1 0x7f6e38b66740 overlay "vc" not found 608d43ae.18d6dd5c 0x7f6e38b66740 slapd.conf: line 13: <overlay> handler exited with 1! Also tried to load it in global section but this also does not work. The following files are installed (and other overlays from this directory load just fine): # ls -al /opt/openldap-ms/lib64/openldap/vc* -rw-r--r-- 1 root root 1008 May 1 02:40 /opt/openldap-ms/lib64/openldap/vc.la lrwxrwxrwx 1 root root 11 May 1 02:40 /opt/openldap-ms/lib64/openldap/vc.so -> vc.so.0.0.0 lrwxrwxrwx 1 root root 11 May 1 02:40 /opt/openldap-ms/lib64/openldap/vc.so.0 -> vc.so.0.0.0 -rwxr-xr-x 1 root root 18824 May 1 02:40 /opt/openldap-ms/lib64/openldap/vc.so.0.0.0 Find build config herein: https://build.opensuse.org/package/view_file/home:stroeder:openldap25/openl… What's wrong here? Ciao, Michael. ------------------ snip ----------------- moduleload back_mdb moduleload vc include /opt/openldap-ms/etc/openldap/schema/core.schema database mdb directory data/test suffix o=test rootdn cn=root,o=test rootpw secret overlay vc

2 2

Spec for LDAP Verify Credentials operation
by Michael Ströder 01 May '21

01 May '21

HI! Is there a spec for client-side implementation of LDAP Verify Credentials operation? I assume that one has to grant auth access to 'userPassword' to the entity sending the VC operation. Ciao, Michael.

2 1

multival member ...
by Michael Ströder 30 Apr '21

30 Apr '21

HI! Experimenting with 2.5.4 I wonder what are reasonable values for applying multival to attribute 'member' in group entries. I guess this depends on length of member DN values. Is there a clear way to calculate this? Or how to find out the effect of current settings. Ciao, Michael. P.S.: Yes, I know I have to reload the database when adding multival config option.

2 1

Groups and accesses
by Клеусов Владимир Сергеевич 27 Apr '21

27 Apr '21

Hi, there was an idea to use OpenLDAP as an address book for mail. Tell me the idea of how to make it so that there are two groups. The members of one see all of them (i.e. the general address book) and only the admin edits them. The members of the other are only seen and edited by the owner (i.e. the personal address book)

1 0

Unable to delete root entry
by Николай Данилов 26 Apr '21

26 Apr '21

When installing openldap with database mdb, root entry cannot be deleted. Tested on systems: OS Linux Debian 10, slapd 2.4.57+dfsg-2 Arch Linux, openldap 2.4.58-1 Oracle Linux 8, openldap 2.4.58 (from source) The root entry was created by the command: ldapadd -x -D 'cn=admin,dc=example,dc=org' -f root_entry.ldif Content of the root_entry.ldif file: dn: dc=example,dc=org objectClass: dcObject objectClass: organization dc: example o: Example description: Example directory dn: cn=root,dc=example,dc=org objectClass: organizationalRole cn: root description: Directory Manager Trying to delete the root entry: ldapdelete -x -r 'dc=example,dc=org' -D 'cn=admin,dc=example,dc=org' -w admin Output - ldap_delete: No such object (32) How can I delete the root entry and create a new one with other structural objectclasses?

3 9

OpenLDAP 2.5 Release Candidate Testing (OpenLDAP 2.5.4)
by Quanah Gibson-Mount 24 Apr '21

24 Apr '21

This is a testing call for OpenLDAP 2.5 Release Candidate (OpenLDAP 2.5.4) Depending on the results, this may be the only testing call. Generally, get the code for RE25: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Note that there are new features in 2.5, so please examine the options available with configure carefully. Some examples: The new load balancer, which can either be built as a module for slapd (--enable-balancer=mod) or as a standalone server (--enable-balancer=yes) The libargon2 password module (--enable-argon2). Systemd notification support (--with-systemd=yes). Thanks! Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

6 13

Best way to secure LDAP to public Server
by work＠seyboldt.org 19 Apr '21

19 Apr '21

Hey, i need to open my LDAP-Directory to a public available Server. What is the best secure way to connect my LDAP-Server to my Public server? I thought about a proxy to my Firewall there I could specify requests to my LDAP-Server, or is there a better or an official way to do this? Thanks, RMs3Q

2 3

[Open Source Experience] Call for Papers is open
by Clément OUDOT 19 Apr '21

19 Apr '21

Hello, there will be a big Open Source event in Paris in november. I am part of the program commitee and would like to know if some of you would be interested to submit talks: https://sessionize.com/opensource-experience/ You can reach me directly if you have some questions on the subject. Regards, -- Clément Oudot | Identity Solutions Manager clement.oudot(a)worteks.com Worteks | https://www.worteks.com

1 0

Config files & env vars not read when geteuid() != getuid()
by Norm Green 19 Apr '21

19 Apr '21

Hello LDAP users and maintainers, libraries/libldap/init.c has this code which bypasses read all LDAP config env vars when the exe loadlig libldap is running in setuid mode. This is causing problems for one of our customers who routinely run our product Linux executables (which load our libldap) in setuid mode for legitimate purposes. Since we have the source, we can and may change this code. In our case, customer wants to set env var LDAPCONF to point at a non-default conf file but is unable to do so. In fact this code bypasses almost all ways an alternate config file can be read. Even $HOME/ldap.conf is not read. My question here is should this code be considered a bug and changed to be less restrictive? I fully appreciate there should be restrictions when in setuid mode but the current code seems too restrictive. init.c: 686 687 openldap_ldap_init_w_sysconf(LDAP_CONF_FILE); 688 689 #ifdef HAVE_GETEUID 690 if ( geteuid() != getuid() ) 691 goto done; 692 #endif 693 694 openldap_ldap_init_w_userconf(LDAP_USERRC_FILE); 695 Norm Green GemTalk Systems LLC

3 2

default config file
by Rallavagu Kon 17 Apr '21

17 Apr '21

Hello All, Noticing a difference in behavior of locating config file at the time of startup between 2.4.48 and 2.4.58. The 2.4.48 is a ubuntu supplied package while 2.4.58 is compiled with following options. ./configure --prefix=/opt/openldap \ --sysconfdir=/etc/ldap \ --localstatedir=/opt/openldap/var \ --libexecdir=/opt/openldap/lib \ --disable-static \ --enable-debug \ --with-tls=openssl \ --with-cyrus-sasl \ --enable-dynamic \ --enable-crypt \ --enable-spasswd \ --enable-slapd \ --enable-modules \ --enable-rlookups \ --enable-backends=mod \ --disable-ndb \ --disable-sql \ --disable-shell \ --disable-bdb \ --disable-hdb \ --enable-overlays=mod When started the slaps in debug mode, I see the following for 2.4.48 6077b590 backend_startup_one: starting "cn=config" 6077b590 ldif_read_file: read entry file: "/etc/ldap/slapd.d/cn=config.ldif” Essentially, looking for “cn=config”. However, after replacing the binaries with compiled version for 2.4.58, 6077b37d could not stat config file "/etc/ldap/slapd.d/slapd.conf": No such file or directory (2) I clearly notice that existing configuration file(s) are not considered with 2.4.58. Wondering what is the difference and how can I use the existing configuration files. Thanks

3 3

Re: performance tuning for n-way and heavy client load
by Zetan Drableg 16 Apr '21

16 Apr '21

>> >> Do you have a lot of large groups that you frequently update? >> > >> > Yes we have several groups with ~40k users from which we frequently >> > add/remove users based on upstream user provisioning workflows. >> >> Are you replacing the entire group when you do that, or only >> adding/deleting specific users? >> >> Either way, for 2.4 you definitely want to use sortvals. Likely what you >> need is OpenLDAP 2.5's multival feature as well. We incrementally insert users and group memberships instead of replacing the entire group every time. This mailing list helped me discover that "sortvals member" improved performance of single record inserts, but didn't help the overall problem. Why do excess free pages in MDB impact performance when inserting new data? On Fri, Apr 16, 2021 at 11:05 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > --On Friday, April 16, 2021 12:01 PM -0700 Zetan Drableg > <zetan.drableg(a)gmail.com> wrote: > > >> Do you have a lot of large groups that you frequently update? > > > > Yes we have several groups with ~40k users from which we frequently > > add/remove users based on upstream user provisioning workflows. > > Are you replacing the entire group when you do that, or only > adding/deleting specific users? > > Either way, for 2.4 you definitely want to use sortvals. Likely what you > need is OpenLDAP 2.5's multival feature as well. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com>

1 0

Re: performance tuning for n-way and heavy client load
by Zetan Drableg 16 Apr '21

16 Apr '21

> >> When I write LDIFs to one node like delete user or remove user from > >> group, we see spikes in authentication latency metrics (what's normally > >> .2 - .5 second response time goes up to 15-30 seconds) across all nodes > >> in the cluster at the same time. > > > > I ran mdb_copy -c to compact the LDAP databases. The size went from > > 2.9G to 140M and the latency problem during inserts went away. > > I've noticed the LDAP data.mdb is growing about 25M per day. What > > accounts for the growth of free pages? > > Do you have a lot of large groups that you frequently update? Yes we have several groups with ~40k users from which we frequently add/remove users based on upstream user provisioning workflows.

2 1

performance tuning for n-way and heavy client load
by Zetan Drableg 16 Apr '21

16 Apr '21

openldap 2.4.57 on 16 core OracleLinux VMs with NVME disk. 8 nodes in n-way multi master configuration, MDB backend, 50k unique DNs. We see about 10,000 auths per minute per node. Under heavy client load, the log shows many "deferring operation: binding" messages in the same second. slapd is using only 400% cpu (of 1600 possible). [2021-04-13 19:15:58] connection_input: conn=150474 deferring operation: binding When I write LDIFs to one node like delete user or remove user from group, we see spikes in authentication latency metrics (what's normally .2 - .5 second response time goes up to 15-30 seconds) across all nodes in the cluster at the same time. What knobs can be adjusted to allow for more concurrency? It seems like writes are impacting reads. *slapd.conf: threads* default is 32, tried 64 and 128 with little improvement *slapd.conf: syncrepl* Should I increase sessionlog size? Should I increase checkpoint ops? How to determine optimum values? syncprov-checkpoint 100 5 syncprov-sessionlog 100 syncprov-reloadhint TRUE *mdb* maxsize 17179869184 *Indices* index objectClass eq,pres index cn,uid,mail,mobile eq,pres,sub index o,ou,dc,preferredLanguage eq,pres index member,memberUid eq,pres index uidNumber,gidNumber eq,pres index memberOf eq index entryUUID eq index entryCSN eq index uniqueMember eq index sAMAccountName eq *ulimit* bash-4.2$ ulimit -a core file size (blocks, -c) 0 data seg size (kbytes, -d) unlimited scheduling priority (-e) 0 file size (blocks, -f) unlimited pending signals (-i) 482391 max locked memory (kbytes, -l) unlimited max memory size (kbytes, -m) unlimited open files (-n) 1048576 pipe size (512 bytes, -p) 8 POSIX message queues (bytes, -q) 819200 real-time priority (-r) 0 stack size (kbytes, -s) 8192 cpu time (seconds, -t) unlimited max user processes (-u) unlimited virtual memory (kbytes, -v) unlimited file locks (-x) unlimited *n-way config* serverID 1 ldap://XXXX:12389 syncrepl rid=1 provider=ldap://XXXXXX:12389 bindmethod=simple starttls=yes tls_cert=/opt/slapd/conf/cert.pem tls_cacert=/etc/pki/tls/cert.pem tls_key=/opt/slapd/conf/key.pem binddn="cn=replication_manager,dc=service-accounts,o=Root" credentials="YYYYYY" tls_reqcert=never searchbase="" schemachecking=on type=refreshAndPersist retry="60 +" (and 7 more) mirrormode on Any ideas? Thanks -Zetan

3 5

Timeout values in search_ext(), ldap_result() and global
by varun mittal 16 Apr '21

16 Apr '21

I am using openldap-2.4.39 on CentOS 7, to query my AD server, with python-ldap wrapper I set the following scheme: ldap.set_option(ldap.OPT_NETWORK_TIMEOUT, 30) ldap.set_option(ldap.OPT_TIMEOUT, 120) conn = ldap.initialize(ldap://server-ip) Using 3 types of queries - synchronous search_s(), asynchronous with and without paging search_ext() I am not using any timeout in the _ext method or the result3() methods One of my python client LDAP searches(asynchronous with paging) took about 14 minutes to complete, in the customer environment. Eventually, the search was successful. Looking at the documentation, I am not sure which timeout value would be applicable here. I thought setting OPT_TIMEOUT should suffice for all kinds of searches. And the strange thing is that the similar query, but synchronous( ldap_search_ext_s) from my C client failed within 120 seconds. This is the default AD server timelimit. The C application didn't specify any timeouts What am I missing here?

3 5

Problems setting up a proxy
by Hans van Zijst 16 Apr '21

16 Apr '21

Hi, After more than a day of fiddling with it, I turn to you, the gurus ;) I'm trying to create an OpenLDAP proxy that will talk to 2 OpenLDAP servers, doing MirrorMode replication and using a floating IP so that I can point all write queries to one and the same server. Those 2 MirrorMode servers are up and running and doing fine, but I can't figure out how to make that proxy. I'm running on Debian Bullseye (still "testing" at this moment), with OpenLDAP 2.4.57, both on the backend servers and the proxy I'm trying to make. I'm not using TLS yet, that's for later. After installation, there's an (empty, of course) mdb database. I think I should throw that away, but I'm not sure. The suffix in that database is different than the one I need to proxy, so it's probably not a problem to leave it there. I have loaded the extra schemas that I use on the MirrorMode machines, and loaded the backends ldap and meta, with LDIF files like this: dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: back_ldap.la And fed that to slapd with ldapmodify -Y EXTERNAL -h ldapi:/// -f <file> I checked with ldapvi and saw both modules loaded. So far, so good. Now I need to create the backend, and this is where I keep running into problems. Although the use of slapd.conf has fallen from grace a long time ago, every example I can find online only uses that. So I tried creating one and adding it to the configuration with slaptest. This is what I came up with: backend meta database meta suffix "dc=example,dc=com" rootdn "cn=admin,dc=example,dc=com" rootpw "super secret passwd" uri "ldap://172.16.7.6/dc=example,dc=com" readonly yes acl-authcDN "cn=admin,dc=example,dc=com" acl-passwd "super secret passwd" uri "ldap://172.16.7.7/dc=example,dc=com" readonly yes acl-authcDN "cn=admin,dc=example,dc=com" acl-passwd "super secret passwd" uri "ldap://172.16.7.8/dc=example,dc=com" readonly no acl-authcDN "cn=admin,dc=example,dc=com" acl-passwd "super secret passwd" But when I try to convert that, I get an error: # slaptest -f /root/proxybackend.conf -F /etc/ldap/slapd.d 6075bced /root/proxybackend.conf: line 1: <backend> failed init (meta)! slaptest: bad configuration directory! The information in the OpenLDAP Handbook is, well, lacking: https://openldap.org/doc/admin24/backends.html#Metadirectory I had hoped to find a way to create an LDIF file which I could add with ldapadd, but I never came much further than this: dn: olcDatabase=meta objectClass: olcDatabaseConfig objectClass: olcMetaConfig olcDatabase: meta olcSuffix: dc=example,dc=com olcRootDN: cn=admin,dc=example,dc=com olcRootPW: "super secret passwd" which results in: adding new entry "olcDatabase=meta" ldap_add: Server is unwilling to perform (53) additional info: no global superior knowledge I'm pretty sure I need more lines in that, to begin with the URI lines to point the proxy to the machines it needs to contact, but I couldn't find the olcSomeThing syntax for them. I'm pretty good at searching, but not so good at finding, unfortunately. Can somebody give me a few hints please? I'm pretty sure I'm missing something small here, but I'm stuck. Kind regards, Hans

2 3

mdb_substring_candidates: (cn) not indexed
by Клеусов Владимир Сергеевич 15 Apr '21

15 Apr '21

Hi, In logs mdb_substring_candidates: (cn) not indexed But slapcat -b cn=config | grep olcDbIndex olcDbIndex: cn eq Please tell me what this message is about ?

3 3

Getting MDB_MAP_RESIZED error, followed by slapd (appearing to) freeze
by Leonardo Bruno Lopes 15 Apr '21

15 Apr '21

Hello everyone. I could find (very) few results while searching the internet for MDB_MAP_RESIZED error in OpenLDAP, and they were of no help. I'll describe my setup and the circumstances of the error. I have OpenLDAP (version 2.4.47) and LMDB (version 0.9.22) installed from Debian 10 default packages in a amd64 box. Along with some usual settings (my slapd.conf file is attached), I set the main database up using the mdb backend with maxsize = 7516192768 (7GB). The on-disk base size (the data.mdb file) is 134MB. I also have loglevel = stats. Everything seems to work flawless and fast, so all of a sudden syslog prints this message: Apr 14 09:47:56 my-ldap-box slapd[20736]: mdb_opinfo_get: err MDB_MAP_RESIZED: Database contents grew beyond environment mapsize(-30785) and seconds later, the slapd daemon stop to answer requests, although the service appears to be still running. This has happened 7 times since April 7, when I moved the data from an old server to this one. I changed loglevel to 'stats trace args shell' and I realized that when the error occurs, there were always some ADD operations logged right before. I inspected the logs today, April 14, right after the occurrence of the error and attached a file containing: 1) the error message, which appears at 09:47:56, 2) the messages logged before, since 09:47:50, 3) the messages logged after, until 09:48:01. This time on, slapd logged no more messages and appeared to be stuck for the clients. At 09:53:41 I restarted the daemon. The log generated from this time until the first request answered is also attached. For the record, I initially suspected of the replica server which was running alongside the main server and which showed the same behavior. This was because at then I associated the error with syncrepl operations. But even after I stop the replica, the error keeps ocurring in the main server. Any clues? Thanks for your consideration. -- Atenciosamente, Leonardo Lopes INFRA-TI / DTI -- Esta mensagem foi verificada pelo sistema de antiv��rus e acredita-se estar livre de perigo.

4 14

be_modify failed(16)
by Rallavagu Kon 14 Apr '21

14 Apr '21

Hello All, OpenLDAP server 2.4.49 Setup with replication Noticing following error messages in server logs, Apr 14 19:56:19 openldap-service-0 slapd[51]: syncrepl_null_callback : error code 0x10 Apr 14 19:56:19 openldap-service-0 slapd[51]: syncrepl_entry: rid=103 be_modify failed (16) As the error code “16” suggested, validated the schema across participating nodes and found no discrepancies in the schema configuration across nodes. However, we are noticing that one of the entries is missing from one node out of three participating replicas (multi master). Any pointers on where to start to debug to understand the issue and fix it. Thanks in advance.

2 3

replication of cn=config
by Stefan Kania 14 Apr '21

14 Apr '21

Hello, I just try to set up the replication for cn=config using the example from the documentation: https://www.openldap.org/doc/admin24/replication.html I have 3 Provider in an MMR with delta-syncrpl. Delta-syncrepl is working fine I can add and change objects from all three providers. Then I set up the replication for cn=config. Here are the changes I made on all three providers: ----------- olcServerID: 1 ldap://hm-01.example.net olcServerID: 2 ldap://hm-02.example.net olcServerID: 3 ldap://hm-03.example.net ... # {0}config, config dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break olcRootDN: cn=admin,cn=config olcRootPW: {SSHA}Uyelb0kyqWuEqr4QmfvrpDaD7VYjeU8h olcSyncrepl: {0}rid=001 provider=ldap://hm-01.example.net binddn="cn=admin,cn= config" bindmethod=simple credentials=geheim searchbase="cn=config" type=ref reshAndPersist retry="5 5 300 5" timeout=1 starttls=yes olcSyncrepl: {1}rid=002 provider=ldap://hm-02.example.net binddn="cn=admin,cn= config" bindmethod=simple credentials=geheim searchbase="cn=config" type=refr eshAndPersist retry="5 5 300 5" timeout=1 starttls=yes olcSyncrepl: {2}rid=003 provider=ldap://hm-03.example.net binddn="cn=admin,cn= config" bindmethod=simple credentials=geheim searchbase="cn=config" type=refr eshAndPersist retry="5 5 300 5" timeout=1 starttls=yes olcMirrorMode: TRUE # {0}syncprov, {0}config, config dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov ---------------- It's same on all three providers. When I do a change on the first provider (hm-01) the change will be replicat to hm-02 and hm-03. But if I try to change or add an ACL on one either hm-02 or hm-03 the change will not be replicated to the other providers. I'm using Debian 10 with the OpenLDAP-packages from debian-backport version 2.4.57. Before setting up the replication for cn=config I checked that the configuration on all three providers are the same. So what did I do wrong or did I miss something Stefan

3 4

Enable support for TLS 1.2 and 1.3, and disable support for TLS 1.0.
by CLARKE, ED C 13 Apr '21

13 Apr '21

Hello, I am having trouble disabling TLS1.0 on my OpenLdap and enabling TLS 1.2 & 1.3, below are the scan results: * Enable support for TLS 1.2 and 1.3, and disable support for TLS 1.0. * "Consult the application's documentation to disable SSL 2.0 and 3.0. * Use TLS 1.2 (with approved cipher suites) or higher instead." * "Ports found: 389 * TLSv1 is enabled and the server supports at least one cipher." * Info for my LDAP * $ rpm -qa | grep ldap * openldap-clients-2.4.44-21.el7_6.s390x * sssd-ldap-1.16.2-13.el7_6.12.s390x * openldap-2.4.44-21.el7_6.s390x * openldap-servers-2.4.44-21.el7_6.s390x Any help in this matter would be greatly appreciated. Thanks, Ed Ed Clarke Senior Software Engineer Operations Transformation, Real-time Automation & Predictive Insights<http://mysolutions.dev.att.com/GNFO_Solutions/index.jsp> "RAPID" Certified Quality Eng. - ISO 9000/1 Six Sigma - Yellow Belt AT&T Veterans AT&T "ATO" 1010 Pine ST. Shared, St. Louis, MO. 63101 m 636.639.0713 | o 314.335.3158 | ec4397(a)att.com<mailto:ec4397@att.com>

2 2

N-Way + Delta Sync Expected Behavior
by thomaswilliampritchard＠gmail.com 13 Apr '21

13 Apr '21

Hi Friends, I have setup N-Way multi provider with 3 providers all using delta sync as suggested to me previously on this forum. I'd like to report that I am seeing more expected results this time around when loading from a backup database and turning on replication so thank you for the suggestions. I would like to describe the behavior I am seeing in hopes to confirm this is expected and proper behavior in 3-Way Multi Master provider persistent delta sync configuration. I have provider1, provider2, provider3 all configured to replicate from each other with refresh and persist delta sync repl. When I issue a write to provider 1 I see it send the update to provider2 and provider3. I then see provider2 and provider3 "syncprov_qresp: set up a new syncres mode=1" for each consumer that is connected to them (including the other provider that did not send the write). Provider 2 then sends a message to provider 3 that ignores it because "CSN too old, ignoring 20210410001522.122666Z#000000#065#000000 (reqStart=20210410001522.000001Z,cn=accesslog)". At the same time provider 3 sends a message to Provider 2 that gets ignored in the same way. Since it is expected that all consumers know about all providers it is perplexing to me why the providers "forward" the update along to its own known consumers. It seems this could be expected given my amateur ldap knowledge but I wanted to confirm because I don't immediately understand why that behavior is necessary (results in ignored messages). Thank you for your consideration Thomas

2 1

Problems setting up a proxy
by Hans van Zijst 13 Apr '21

13 Apr '21

Hi, After more than a day of fiddling with it, I turn to you, the gurus ;) I'm trying to create an OpenLDAP proxy that will talk to 2 OpenLDAP servers, doing MirrorMode replication and using a floating IP so that I can point all write queries to one and the same server. Those 2 MirrorMode servers are up and running and doing fine, but I can't figure out how to make that proxy. I'm running on Debian Bullseye (still "testing" at this moment), with OpenLDAP 2.4.57, both on the backend servers and the proxy I'm trying to make. I'm not using TLS yet, that's for later. After installation, there's an (empty, of course) mdb database. I think I should throw that away, but I'm not sure. The suffix in that database is different than the one I need to proxy, so it's probably not a problem to leave it there. I have loaded the extra schemas that I use on the MirrorMode machines, and loaded the backends ldap and meta, with LDIF files like this: dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: back_ldap.la And fed that to slapd with ldapmodify -Y EXTERNAL -h ldapi:/// -f <file> I checked with ldapvi and saw both modules loaded. So far, so good. Now I need to create the backend, and this is where I keep running into problems. Although the use of slapd.conf has fallen from grace a long time ago, every example I can find online only uses that. So I tried creating one and adding it to the configuration with slaptest. This is what I came up with: backend meta database meta suffix "dc=example,dc=com" rootdn "cn=admin,dc=example,dc=com" rootpw "super secret passwd" uri "ldap://172.16.7.6/dc=example,dc=com" readonly yes acl-authcDN "cn=admin,dc=example,dc=com" acl-passwd "super secret passwd" uri "ldap://172.16.7.7/dc=example,dc=com" readonly yes acl-authcDN "cn=admin,dc=example,dc=com" acl-passwd "super secret passwd" uri "ldap://172.16.7.8/dc=example,dc=com" readonly no acl-authcDN "cn=admin,dc=example,dc=com" acl-passwd "super secret passwd" But when I try to convert that, I get an error: # slaptest -f /root/proxybackend.conf -F /etc/ldap/slapd.d 6075bced /root/proxybackend.conf: line 1: <backend> failed init (meta)! slaptest: bad configuration directory! The information in the OpenLDAP Handbook is, well, lacking: https://openldap.org/doc/admin24/backends.html#Metadirectory I had hoped to find a way to create an LDIF file which I could add with ldapadd, but I never came much further than this: dn: olcDatabase=meta objectClass: olcDatabaseConfig objectClass: olcMetaConfig olcDatabase: meta olcSuffix: dc=example,dc=com olcRootDN: cn=admin,dc=example,dc=com olcRootPW: "super secret passwd" which results in: adding new entry "olcDatabase=meta" ldap_add: Server is unwilling to perform (53) additional info: no global superior knowledge I'm pretty sure I need more lines in that, to begin with the URI lines to point the proxy to the machines it needs to contact, but I couldn't find the olcSomeThing syntax for them. I'm pretty good at searching, but not so good at finding, unfortunately. Can somebody give me a few hints please? I'm pretty sure I'm missing something small here, but I'm stuck. Kind regards, Hans

1 0

N-WAY replication, contextCSNs and olcSpNoPresent
by thomaswilliampritchard＠gmail.com 09 Apr '21

09 Apr '21

I am migrating from single provider to N-Way provider in OpenLDAP 2.4.56 This configuration was setup years ago and reading the docs has me questioning this piece of configuration. I notice we have no present configured on our syncprov overlay for our primary DB setup for delta sync. I noticed in the docs it explains " The nonpresent option should only be configured if the overlay is being placed on top of a log database, such as when used with delta-syncrepl. The nonpresent option is configured by the syncprov-nopresent <TRUE|FALSE> directive. This value should only be set TRUE for a syncprov instance on top of a log database (such as one managed by the accesslog overlay). The default is FALSE. " dn: olcDatabase={2}mdb,cn=config changetype: modify replace: olcDbCheckpoint olcDbCheckpoint: 1024 10 - replace: olcDbIndex ... indexes ... - replace: olcDbMaxSize olcDbMaxSize: 5000000000 - replace: olcDbNosync olcDbNosync: TRUE dn: olcOverlay=syncprov,olcDatabase={2}mdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpNoPresent: TRUE Should this olcSpNoPresent piece be removed from our configuration? What adverse affects would this generate if it is in fact an incorrect piece of configuration? Delta-Sync between our consumers and provider seem to function. I am worried this could cause problems on my journey to N-Way provider replication. Next, I am testing new architecture for N-Way but see that the new context CSNs generated by those new providers also show up in the initial provider. If I want to "go back" to my original system state before my N-Way testing, can I simply delete the ContextCSNs from an exported LDIF and reload the database? Or is that asking for trouble?

2 1

n-way multi provider set up and mdb_copy
by paul.jc＠yahoo.com 08 Apr '21

08 Apr '21

Hello, I am setting up n-way multi-provider replication. Should we expect a full sync when we setup sync for the first time on a new provider? Can we load a backup data.mdb file first and have deltasync run from there to prevent a full sync (i.e. to save time)? What is the expected behavior/best practice? Also, I have some questions around mdb_copy. Is there any concern using the -c flag for compacting the data.mdb file to be used for restore (or new n-way provider if that works)? I notice the compacted file is smaller on disk than the original data.mdb (due to the removed freed pages). I assume the data sets are still the same? Are there tools to compare the two? And last question, I am using mdb_copy to create a backup but standard linux cp to put the new file into /var/lib/ldap/data.mdb. Will this cause any issues or is it recommended to use mdb_copy to also move the data.mdb file into place? Thanks! Paul

3 3

Migration from OpenLDAP to Oracle Directory Servers (OUD or ODSEE)
by borabaysal＠borabaysal.com 08 Apr '21

08 Apr '21

Hi, I was wondering if anyone has successfully made schema and data migration from OpenLDAP (current version: openldap-2.4.49) to OUD (Oracle Unified Directory 11g) or ODSEE (Oracle Directory Server Enterprise Edition 11g). We are trying to make Zimbra servers (currently using OpenLDAP directory on each server Zimbra installed) use a centralized MMR-enabled OUD environment. But we couldn't find any migration documentation on that. Thanks, -Bora

4 8

hide attribute with specific value only
by Chris Leung 08 Apr '21

08 Apr '21

Dear all, Is it possible to hide a attribute for a specific value only? e.g., dn: ...... objectClass: ... attr1: A attr1: B E.g., I would like to hide the 'attr1: A' for some DNs binding, but, 'attr1: B' should be visible for the client. Chris

2 1

Trust your own (Domain Controller's) CA cert with ldapsearch/openldap
by Wiebe Cazemier 08 Apr '21

08 Apr '21

Hi, I'm having difficulty making tools like ldapsearch accept SSL certificates signed by a Windows domain controller, even when the trust chain seems good. The problem extends to PHP, which uses openldap (PHP debug logging shows the exact same errors). We manually trusted the CA certifcate of the domain controller: cp -v /tmp/PDC02CA.crt /usr/local/share/ca-certificates update-ca-certificates OpenSSL approves it (it doesn't aprove without the previous step): # openssl verify -verify_hostname PDC01.city.cmpny.local /tmp/PDC01.city.cmpny.local.crt /tmp/PDC01.city.cmpny.local.crt: OK And: openssl s_client -verify_hostname PDC01.city.cmpny.local -connect PDC01.city.cmpny.local:3269 CONNECTED(00000005) depth=1 DC = local, DC = cmpny, DC = city, CN = city-PDC02-CA verify return:1 depth=0 verify return:1 --- Certificate chain 0 s: i:DC = local, DC = cmpny, DC = city, CN = city-PDC02-CA But ldapsearch just will not approve it: $ ldapsearch -d1 -H ldaps://PDC01.city.cmpny.local:3269 ldap_url_parse_ext(ldaps://PDC01.city.cmpny.local:3269) ldap_create ldap_url_parse_ext(ldaps://PDC01.city.cmpny.local:3269/??base) [..snip...] ldap_connect_to_host: TCP PDC01.city.cmpny.local:3269 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.105.10.10:3269 ldap_pvt_connect: fd: 3 tm: -1 async: 0 attempting to connect: connect success TLS: peer cert untrusted or revoked (0x102) TLS: can't connect: (unknown error code). ldap_msgfree ldap_err2string ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) additional info: (unknown error code) Running 'strace' shows '/etc/ssl/certs/ca-certificates.crt' is properly read. Doing all the standard tricks with 'LDAPTLS_CACERT, TLS_CACERT', pointing directly to '/tmp/PDC02CA.crt', editing '/etc/ldap/ldap.conf' with all possible permutations. Nothing works, except 'TLS_REQCERT never'. Other certificates are accepted when testing public servers. They are just https, but for SSL tests that doesn't matter. Like: ldapsearch -d1 -H ldaps://www.google.com:443 Or ldapsearch -d1 -H ldaps://www.amazon.co.uk:443 The latter only has the correct domain name in the 'subject alternate name', not the common name. I theorized that maybe the SAN was a cause, but this test result, and [1], show that should work fine. If I deliberately try to create a hostname mismatch, it says: 'TLS: hostname (blabla.com) does not match common name in certificate (www.amazon.co.uk)'. Very different from my 'peer cert untrusted or revoked'. Could this be a bug (in GnuTLS)? Versions: ldapsearch: @(#) $OpenLDAP: ldapsearch (Ubuntu) (Feb 18 2021 14:22:42) Ubuntu: 18.04.5 LTS libgnutls30: 3.5.18-1ubuntu1.4 Regards, Wiebe [1] https://www.openldap.org/lists/openldap-technical/201310/msg00167.html

1 0

Authentication by the mail attribute
by Клеусов Владимир Сергеевич 07 Apr '21

07 Apr '21

Hi Please tell me how (if possible) to authenticate in OpenLDAP not by cn but by the mail attribute ?

3 3

Replacing the server during replication
by Клеусов Владимир Сергеевич 06 Apr '21

06 Apr '21

Hi, I have multi-master replication configured. https://pastebin.com/vYKsa9VY I want to replace ldap3. Please tell me how to do this ? I mean, how does the new server synchronize the current ldap database?

4 11

RE: [EXT]:Re: Openldap client is not populating GID name instead of it just getting GID with empty Group name
by Quanah Gibson-Mount 06 Apr '21

06 Apr '21

--On Monday, April 5, 2021 2:37 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > Quanah, > > Good Morning !!! > > On Last weekend , finally migration went fine . > > I have modified loglevel to stats and increased slapd file descriptor to > 8192 which resolve the issue. Looks like in RHEL7 somehow with value 2k > it's not working where as it's used to work in RHEL6. > > It's bit interesting , No errors reported with ulimit issues in the logs. Glad to hear it! :) Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

is there a standard way to store social media handle?
by Zhang 05 Apr '21

05 Apr '21

Hi. I was certain that I could find this in the archives but failed. What's the recommended way to extend inetOrgPerson to include twitter handle, facebook ID and other social media contact points? There doesn't seem to be OID defined for these attributes. Thanks

1 0

OpenLDAP and CBT
by pankovdv＠skbkontur.ru 05 Apr '21

05 Apr '21

Hello everyone! Does openldap support CBT (Channel Binding Tokens)?

1 0

Simulating/inducing server errors to test client application
by varun mittal 05 Apr '21

05 Apr '21

Is there any easy way of mocking errors(network timeout, search time limit exceeded etc.) from OpenLDAP server to test if client exception are being handled properly ?

2 2

OpenLDAP 2.5.3 Beta binary builds for testing
by Quanah Gibson-Mount 03 Apr '21

03 Apr '21

Symas is pleased to provide binary builds of the OpenLDAP 2.5.3 beta for testing purposes only on the following select platforms. Builds install into /opt/openldap25/ with state files stored in /var/opt/openldap25/ so as to be entirely self contained. No init scripts are provided and it is expected that end testers are familiar with OpenLDAP configuration. Please file any software (not packaging) related issues found at https://bugs.openldap.org/ These builds include a number of contrib modules in addition to the stock OpenLDAP offerings. Platforms: Ubuntu 20.04 LTS RHEL8 and binary compatible distributions (note: requires EPEL) Fedora 34 -------------------------------------------------- Ubuntu 20.04 LTS installation instructions: sudo add-apt-repository ppa:symas/openldap25 sudo apt-get update sudo apt install openldap-clients openldap-server -------------------------------------------------- -------------------------------------------------- RHEL8 installation instructions: dnf install 'dnf-command(copr)' dnf install epel-release dnf copr enable symas/openldap25 yum install openldap25-libs openldap25-clients openldap25-server -------------------------------------------------- -------------------------------------------------- Fedora 34 installation instructions: dnf install 'dnf-command(copr)' dnf copr enable symas/openldap25 yum install openldap25-libs openldap25-clients openldap25-server -------------------------------------------------- Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

RE: [EXT]:Re: Openldap client is not populating GID name instead of it just getting GID with empty Group name
by Quanah Gibson-Mount 02 Apr '21

02 Apr '21

--On Friday, April 2, 2021 6:29 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > HI Quanah, > > Any help would be appreciated, I am making sure to collecting additional > logs. In case if you get a time to look the issue and help us. Don't spam the list, you already sent this email. I've nothing further to add at this time. I would note that loglevel is not debug (terminology is important). If you had a ulimit issue where you were running out of file descriptors in the slapd process, then that would be clearly logged. I don't suggest making gratuitous changes that are not backed up by documented evidence. --Quanah > We are scheduling the change ticket for this weekend. I just want to make > sure below action items I am going to try. > > 1) enable the debug logs >>> loglevel stats in ldap.conf > 2) would like to increase the ulimit to 16K from 4k to just rule out > limit issue. > > After enabling the debug logs will capture the logs from master and > clients(2-3) to review later. I guess I will see the same issue after the > cutover from old servers to new servers and I will roll back to old > servers . > > Let me know if you have other suggestion to capture more data. > > -Narayanan > > -----Original Message----- > From: Ballem, Narayanan > Sent: Wednesday, March 31, 2021 11:41 AM > To: Quanah Gibson-Mount <quanah(a)symas.com>; > openldap-technical(a)openldap.org Subject: RE: [EXT]:Re: Openldap client is > not populating GID name instead of it just getting GID with empty Group > name > > HI Quanah, > > Hope you are doing good !!! > We are scheduling the change ticket for this weekend. I just want to make > sure below action items I am going to try. > > 1) enable the debug logs >>> loglevel stats > 2) would like to increase the ulimit to 16K from 4k to just rule out > limit issue. > > After enabling the debug logs will capture the logs from master and > clients(2-3) to review later. I guess I will see the same issue after the > cutover from old servers to new servers and I will roll back to old > servers . > > Let me know if you have other suggestion to capture more data. > > Thanks for your valuable time. > > -Narayanan > -----Original Message----- > From: Ballem, Narayanan > Sent: Tuesday, March 23, 2021 2:21 PM > To: 'Quanah Gibson-Mount' <quanah(a)symas.com>; > openldap-technical(a)openldap.org Subject: RE: [EXT]:Re: Openldap client is > not populating GID name instead of it just getting GID with empty Group > name > > Unfortunately I cannot demonstrate right now as my old prod servers live > and I cannot bring new systems into traffic during business hours. I can > schedule the activity on coming on April 3rd/4th where I can collect > additional logging as you mentioned and replicate the issue. > > -Narayanan > > -----Original Message----- > From: Quanah Gibson-Mount <quanah(a)symas.com> > Sent: Tuesday, March 23, 2021 2:13 PM > To: Ballem, Narayanan <Narayanan.Ballem(a)Staples.com>; > openldap-technical(a)openldap.org Subject: RE: [EXT]:Re: Openldap client is > not populating GID name instead of it just getting GID with empty Group > name > > > > --On Tuesday, March 23, 2021 7:05 PM +0000 "Ballem, Narayanan" > <Narayanan.Ballem(a)Staples.com> wrote: > >> Ok I will test this one. >> Unfortunately I cannot test this as I see only during the cutover from >> old to new servers.. >> >> Apart from additional logging do you suggest any tuning to take more >> 5k ldap clients connections ? > > No, you've yet to even demonstrate that OpenLDAP is having any issue. > All you've noted is that you're having some issue somewhere in your stack. > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.sym > as.com%2F&data=04%7C01%7CNarayanan.Ballem%40Staples.com%7C59043688533 > a4266ee4108d8ee274ca1%7Cb101f7ab56ac485fb3975279698fdf7d%7C1%7C0%7C637521 > 199838305231%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIi > LCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=%2FPOxOEnVAaVQGNXLaZUsHSu > asC9LoROX1EQd2biE8FE%3D&reserved=0> -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

openSUSE and SLE packages of OpenLDAP 2.5.3beta available
by Michael Ströder 02 Apr '21

02 Apr '21

On 4/1/21 6:17 AM, project(a)openldap.org wrote: > OpenLDAP 2.5.3beta is now available for experimentation and testing. You can find openSUSE and SLE packages of release 2.5.3beta in this OBS project: https://build.opensuse.org/project/show/home:stroeder:openldap25 Notes: - The packages are experimental and not tested in production. - This is my private work not related to the OpenLDAP project => blame me if something looks wrong with the packaging. - If unsure install openldap-ms, not openldap2, for testing (see below). Safe option: openldap-ms home:stroeder:openldap25/openldap-ms contains packages installed into a separate prefix /opt/openldap-ms. You can safely install these without breaking system-wide libraries and config files. There shouldn't be any conflict with other OS-provided packages. Danger area: openldap2 (You have been warned!) home:stroeder:openldap25/openldap2 is a *replacement* for the OS-provided packages which replaces system-wide client libraries. *This will likely break your system*! If you know what you're doing you can install this into e.g. test VMs, container or similar throw-away deployments. Download repos for various versions: https://download.opensuse.org/repositories/home:/stroeder:/openldap25/ Choose a directory and add the repo like this (example for openSUSE Tumbleweed): zypper addrepo -f https://download.opensuse.org/repositories/home:/stroeder:/openldap25/openS… Refresh your repos: zypper refresh -f Install packages zypper install openldap-ms openldap-ms-contrib Ciao, Michael.

4 4

MDB_MAP_FULL with plenty of free pages
by Jean-Charles ROGEZ 26 Mar '21

26 Mar '21

Hello, We use OpenLDAP 2.4.57 under RHEL8 with a configuration with 2 directories in MM and 2 replicas. We only write on one of the masters. The size of the LMDB database grows following writes of members of large groups (2000 members) by a batch which runs every 10 minutes. The base grows regularly and sometimes undergoes significant jumps until it reaches its maximum size. The lmdb_stat -ef command indicates that very few pages are used and everything else is free pages. The used pages are stable. [cid:image001.jpg@01D720BD.58844450] And yet, it is no longer possible to write in the directory. Sometimes it's on the master directory, sometimes on replicas where syncrepl fails. 2021-03-24T11: 52: 59.978157 + 01: 00 int-ohz-infra1 slapd debug local4 25076 - mdb_id2entry_put: mdb_put failed: MDB_MAP_FULL: Environment mapsize limit reached (-30792) "uid = us-00000301, ou = users, dc = bst, dc = ocn, dc = infra, dc = ftgroup " 2021-03-24T11: 52: 59.978184 + 01: 00 int-ohz-infra1 slapd debug local4 25076 - syncrepl_null_callback: error code 0x50 2021-03-24T11: 52: 59.978202 + 01: 00 int-ohz-infra1 slapd debug local4 25076 - syncrepl_entry: rid = 001 be_modify failed (80) 2021-03-24T11: 52: 59.978780 + 01: 00 int-ohz-infra1 slapd debug local4 25076 - do_syncrepl: rid = 001 rc 80 retrying There is no transaction in progress: mdb_stat -r /var/lib/ldap/data/ Reader Table Status pid thread txnid 25076 7fa0e42c5480 - 25076 7fa0977fe700 - 25076 7fa097fff700 - 25076 7fa094cfa700 - 25076 7fa086ffe700 - 25076 7fa0857fb700 - 25076 7fa0867fd700 - 25076 7fa085ffc700 - 25076 7fa074ffc700 - The batch executes a lot of transactions < 2s. Restarting slapd does not resolve the problem. If we compact the database with mdb_copy -c, it only makes a few MB and it works again. The problem no longer appears without large groups. Why are free pages not used? Wouldn't there be a problem with writing many multi-valued attributes? Thank you for your help ! Jean-Charles Rogez [https://marketing.csnovidys.com/Logos/banniere_mail.png] [twitter icon]<https://twitter.com/csnovidys> [linkedin icon]<https://www.linkedin.com/company/novidy's> Jean-Charles ROGEZ Architecte Système | INTEGRATION SYSTEMES | PLESSIS Standard : +33180848010<tel:+33180848010> Ligne directe : <tel:r> Mobile : <tel:> Email : jean-charles.rogez(a)csnovidys.com<mailto:jean-charles.rogez@csnovidys.com>

7 15

OpenLDAP LTB packages for 2.4.58 are available
by Clément OUDOT 25 Mar '21

25 Mar '21

Hello, LTB packages for OpenLDAP 2.4.58 are available: https://projects.ow2.org/view/ldaptoolbox/ltb-openldap-2-4-58-packages-rele… Download: https://ltb-project.org/download#openldap Thanks to OpenLDAP team and LTB team! Clément.

1 0

RE: [EXT]:Re: Openldap client is not populating GID name instead of it just getting GID with empty Group name
by Quanah Gibson-Mount 23 Mar '21

23 Mar '21

--On Tuesday, March 23, 2021 7:05 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > Ok I will test this one. > Unfortunately I cannot test this as I see only during the cutover from > old to new servers.. > > Apart from additional logging do you suggest any tuning to take more 5k > ldap clients connections ? No, you've yet to even demonstrate that OpenLDAP is having any issue. All you've noted is that you're having some issue somewhere in your stack. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

RE: [EXT]:Re: Openldap client is not populating GID name instead of it just getting GID with empty Group name
by Quanah Gibson-Mount 23 Mar '21

23 Mar '21

--On Tuesday, March 23, 2021 6:45 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > Yes presently logs enabled below in slapd.conf. > and during troubleshoot I have enabled loglevel -1 as well in the past. > ># enable a lot of logging - we might need it ># but generates huge logs ># loglevel -1 > loglevel 17384 I would strongly advise using the logging keywords (see slapd.conf(5)), it makes it a lot simpler to understand what is being done. And initially, just start with: loglevel stats It should generally provide information necessary to see if there are any issues occurring between the server and the backend. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

RE: [EXT]:Re: Openldap client is not populating GID name instead of it just getting GID with empty Group name
by Quanah Gibson-Mount 23 Mar '21

23 Mar '21

--On Tuesday, March 23, 2021 6:39 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > No, F5 is not closing the connections as I see connection on LDAP > servers which are coming via F5 on both the sites and also secondary site > server under F5 as well which are working fine when client connections > are coming via F5. What logging level do you have set on the OpenLDAP server side? I assume you're doing something like using back-ldap to proxy the connection from OpenLDAP to AD? --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

RE: [EXT]:Re: Openldap client is not populating GID name instead of it just getting GID with empty Group name
by Quanah Gibson-Mount 23 Mar '21

23 Mar '21

--On Friday, March 19, 2021 1:39 PM +0000 "Ballem, Narayanan" <Narayanan.Ballem(a)Staples.com> wrote: > > HI , > > Thanks for your time and response. > Looks like I missed this email. > > I don't see issue with AD here, Let me explain bit more > > We have 2 (1 master , 1 slave) servers in each site and those are under > F5 LB with TCP enabled. > > Under F5 setup > Primary site servers takes load around 3K Ldap clients > Secondary site servers take around 50K Ldap clients > > The problem which I am seeing with primary site server directly by > passing F5 layer when we test with 5-10 clients it's working as expected > no issue with GID name fetching however when we enabled servers under F5 > with all the clients we are seeing GID fetching issue. And we are not > offloaded any cert in F5 it just TCP so no issue with F5 here. > Similarly secondary site servers are working fine with F5 or directly > without any issue and Backend AD syncing is working fine in both the > sites. > > Both the sites configuration are intact except systems are in different > locations. > > The only difference I see is no of clients are high in primary site and > no errors in ldap server logs , I am not sure my ldap servers not able to > take more than 100 clients. I am guessing some tuning might required. Are you sure the F5 isn't silently closing connections? This is a common problem with F5's. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

SHA-256 Password Support and OpenLDAP2-2.4.46 SLES15SP2
by Dario García Díaz-Miguel 23 Mar '21

23 Mar '21

Hello, We have a question related with the pw-sha2 module. We have deployed OpenLDAP2.4.46-9.31.1 on SLES15 SP2 from the official Suse Repository and we are able to use {CRYPT} {MD5} {SMD5} {SSHA} and {SHA}. We are awared that in order to support SHA-256 we have to load the contrib module named pw-sha2 which it was included on SLES12SP5 but is totally missing on SLES15SP2 package. This means that we would need to compile it, but due to limitations of the project we are working on we are not allowed to compile anything external. So I checked the changelog and I found that support was added on 2.4.32 release. Is it possible that the openldap2 package could have been compiled with the module features itself and I just need to add some kind of attribute or entry to my LDAP directory in order to enable it? We have tried to use Apache Directory Studio instead of slappasswd and we have set up a password to SHA256 but the bind won't work. Instead, CRYPT-SHA256 works so I can't figure out why. I suppose I'm totally misunderstanding this and the compilation of the module is required, but a little light ray of hope is there. Thank you so much. Regards. P Please consider the environment before printing this e-mail.

6 13

warning in SLAPO_PPOLICY(5) regarding ppolicy_hash_cleartext
by Christopher Paul 23 Mar '21

23 Mar '21

Hello, I read the warning in SLAPO_PPOLICY(5) regarding ppolicy_hash_cleartext: "It is recommended that when this option is used that compare, search, and read access be denied to all directory users". Am I correct to presume that this means that the compare, search, read access be denied for directory users' _own_ (self) userPassword attrs, right? Because compare, search, read access to _other_ users' userPassword is rightfully denied typically by any sensible access control ruleset. (Right?) And if this document does mean to say that compare, search, and read access should be denied for directory users' _own_ (self) userPassword attrs, can someone please explain why, if users can read their userPassword, it would be worse for it to be encrypted than plain text? Many thanks, Chris Paul Rex Consulting, Inc email: chris.paul(a)rexconsulting.net web: http://www.rexconsulting.net <http://www.rexconsulting.net> phone, toll-free: +1 (888) 403-8996 ext 1

3 3

-DSLAPD_MAX_FILTER_DEPTH=xxx
by Michael Ströder 22 Mar '21

22 Mar '21

HI! Looking at comments in ITS#9251 I wonder if and how one should set -DSLAPD_MAX_FILTER_DEPTH= when building OpenLDAP downstream packages. To me the default of 5000 looks way too high. It would be really helpful to have a metric of maximum filter depth sent in by clients in cn=monitor. Ciao, Michael.

2 1

OpenLDAP as AD Proxy: OpenLDAP returning seemingly random number of results?
by Doyon, Jean-François 22 Mar '21

22 Mar '21

Hello, I have been working on implementing OpenLDAP as an AD proxy. I now have a setup that I am happy with over all, except for one strange behaviour: When browsing AD via the proxy, I do not get all the results in a given OU. Notes: * The OUs never contain more than 200-250 entries, well below both AD and OpenLDAP's default limits? * Different LDAP clients end up displaying different amounts of results, though the amount seems to be consistent within a given client. So for OU X ldp.exe shows Y results always, but Apache Directory Studio shows Z results, always. * When doing a search, if I ask to return only specific attributes, the number of results returned shrinks. So when I search on objectClass=* on a given OU I get X results, if I request one attribute only, the list returned shrinks a little bit, if I add another attribute, the list shrinks again! * If I use those exact same clients to connect to AD directly, with all other things being equal, there is no such issue, and all expected results are shown. I never configure any special client limits, paging, etc. on either connection (AD or OpenLDAP). * I am using a binary build of 2.4.49 for Windows. * Authentication is done via local database with a different DN, there is no rebind-as-user. * There are ACLs on the proxy to restrict access to certain OUs. It seems as if I am hitting some sort of limit, as suggest but the fact that when I make a more complex search, the number of results shrinks ... but this does not appear to be a number of results or time limit, and either way I am well under 1000 results and under 60 seconds (The default limits I think?). So ... what's going on? Anyone have any idea? I'm stumped ... Thanks! Jean-François Doyon Gestionnaire, Opérations et sécurité des T.I. Commissariat aux langues officielles jean-francois.doyon(a)clo-ocol.gc.ca<mailto:jean-francois.doyon@clo-ocol.gc.ca> / Tél. : 613-218-0547 Manager, I.T. Operations and security Office of the Commissioner of Official Languages jean-francois.doyon(a)ocol-clo.gc.ca<mailto:jean-francois.doyon@ocol-clo.gc.ca> / Tel: 613-218-0547

1 0

data.mdb grows faster with more frequent commits
by Alec Matusis 22 Mar '21

22 Mar '21

We have an environment with no flags that contains a database with no flags. The database is append only, no deletions or modifications. It is written using a single RW transaction, in the absence of any RO transactions. We observe that when we commit and recreate the RW transaction every 2000 insertion ops, the data.mdb file size on disk is 2x larger than when committing every 64000 insertion ops. The mdb_copy -c utility shrinks the large 2k ops commit file to almost the same file size as the 64k commit one. mdb_stat -e on the data.mdb shows that when we have more commits and bigger file, we have more pages used by the same proportion. In production we will have several large DBs (>1TB) on an NVMe card and we do not have the 2x space for periodic mdb_copy -c compactifications (and we cannot stop the writing process). We also need to commit every 2000 write ops, because there will be short-lived RO transactions that need to see the DB updates every 2000 writes. 1. Why is the file size on disk dependent on the commit frequency? (I suppose because with less frequent commits it can allocate data between pages more efficiently)? 2. What can we do to reduce data.mdb, if we must commit frequently? Can we use any environment, transaction or db flags, or anything else? We are on Linux 5.4.0 / ext4 fs. The DB that grows 2x faster with more frequent commits has bytearr key -> u32 val structure (the byterarray key is between 31 and 36 bytes). Another DB that has a reverse u32 key -> bytearr structure oonly grows 10% larger in the more frequent commits regime.

2 3

OpenLDAP client api documentation
by frpinci＠cisco.com 17 Mar '21

17 Mar '21

Hi, Is there any documentation explaining how to write an LDAP client using the OpenLDAP library? If not, what is the best approach to find out what functions to use and what options should be set for a certain auth method? I am writing a client but I am having issues with ldaps. Without documentation it is hard for me to tell if I am missing something or doing something wrong. Thanks, Francesco

2 1

SLE/openSUSE packages OpenLDAP 2.4.58
by Michael Ströder 16 Mar '21

16 Mar '21

On 3/16/21 7:53 PM, project(a)openldap.org wrote: > OpenLDAP 2.4.58 is now available for download as detailed on our download page: > > https://www.openldap.org/software/download/ As usual you can find SLE and openSUSE packages here: https://build.opensuse.org/package/show/network:ldap/openldap2 Ciao, Michael.

1 0

Symas OpenLDAP for Linux 2.4.58 Released
by Quanah Gibson-Mount 16 Mar '21

16 Mar '21

The latest version of Symas OpenLDAP for Linux is now available for RHEL7, RHEL8, Ubuntu18 LTS, and Ubuntu 20 LTS. <https://repo.symas.com/sofl/> for installation instructions. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Openldap client is not populating GID name instead of it just getting GID with empty Group name
by Ballem, Narayanan 16 Mar '21

16 Mar '21

Hi Team, Seeking help or guidance on this issue. we are using OpenLDAP 2.4.54 version on RHEL7.8 systems and these OpenLDAP servers are using backend Microsoft AD URI to load the User POSIX info. Clients are using SSSD software. On the client's side, we are seeing odd behavior of Group name. it's failing to fetch Group name while logging in to the LDAP clients. uid=1946***(balna**) gid=1478 groups=1478 we have to similar setup on two sites, One site is working fine and the second site is not working sure where is the exact problem both the sites' OpenLDAP configuration is intact and SSL certs are offloaded properly. the only difference I see no of clients connections the working one having fewer client around 25-30 in that site whereas non-working site OpenLDAP servers takes around 3K clients connections, I am not sure if any there is additional tuning required based on no of clients. i also checked limits 4K values set for nproc/nofile and i did not see any issue with limits. we have a similar working two sites setup of 2.4.36 on RHEL6 servers for the same no of clients and we are trying to migrate to RHEL7 with 2.4.54 version where we are seeing the issue. Can you please check and help us to see if similar kind of issue reported by any clients or any tuning in required ? Thanks Narayanan Linux Platform Engineering 500 Staples Drive, Framingham MA Office: 508-253-6909 | Mobile: 508-333-4395 [signature_1767107679]

2 1

Alternative user password attribute
by Benjamin Renard 16 Mar '21

16 Mar '21

Hello, In one of my OpenLDAP installation, I'm start using Ppolicy overlay and it's doesn't allow me to store multiple passwords in userPassword attribute as possible in regular situation. I'm looking for a solution that allowing me to keep using Ppolicy and have possibility to store an alternative user password (usually used by admins). There is a solution to define an alternative attribute password ? Regards, -- Benjamin Renard - Easter-eggsusal 44-46 rue de l'Ouest - 75014 Paris - France - Métro Gaité Phone: +33 (0) 1 43 35 00 37 - Fax: +33 (0) 1 43 35 00 76 mailto:brenard@easter-eggs.com - http://www.easter-eggs.com

3 8

Segmentation fault from mdb_stat -a after successful mdb_copy -c
by Alec Matusis 15 Mar '21

15 Mar '21

I have an environment with one database: alecm@db0 /fusionio1/lmdb> mdb_stat -fear dbgraph-to-compress/vx_to_edg Environment Info Map address: (nil) Map size: 1200000000000 Page size: 4096 Max pages: 292968750 Number of pages used: 24631912 Last transaction ID: 69821 Max readers: 126 Number of readers used: 0 Reader Table Status (no active readers) Freelist Status Tree depth: 2 Branch pages: 1 Leaf pages: 13 Overflow pages: 26338 Entries: 1801 Free pages: 13028375 Status of Main DB Tree depth: 1 Branch pages: 0 Leaf pages: 1 Overflow pages: 0 Entries: 1 Status of vx_to_edg Tree depth: 4 Branch pages: 45690 Leaf pages: 7845337 Overflow pages: 0 Entries: 3993304504 I compressed it (i.e. got rid of Free Pages) with mdb_copy -c dbgraph-to-compress/vx_to_edg/ dbgraph-compressed/vx_to_edg This command exited normaly with return status 0. After executing mdb_stat -a on the compressed database I got SIGSEGV alecm@db0 /fusionio1/lmdb> gdb --args mdb_stat -fear dbgraph-compressed/vx_to_edg GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.3) 7.7.1 Copyright (C) 2014 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from mdb_stat...done. (gdb) r Starting program: /usr/local/bin/mdb_stat -fear dbgraph-compressed/vx_to_edg [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Environment Info Map address: (nil) Map size: 1200000000000 Page size: 4096 Max pages: 292968750 Number of pages used: 11577185 Last transaction ID: 1 Max readers: 126 Number of readers used: 0 Reader Table Status (no active readers) Freelist Status Tree depth: 0 Branch pages: 0 Leaf pages: 0 Overflow pages: 0 Entries: 0 Free pages: 0 Status of Main DB Tree depth: 1 Branch pages: 0 Leaf pages: 1 Overflow pages: 0 Entries: 1 Program received signal SIGSEGV, Segmentation fault. mdb_xcursor_init1 (node=node@entry=0x7ee891ecdfc4, mc=0x6154a0, mc=0x6154a0) at mdb.c:8556 8556 mx->mx_cursor.mc_flags &= C_SUB|C_ORIG_RDONLY|C_WRITEMAP; (gdb) bt #0 mdb_xcursor_init1 (node=node@entry=0x7ee891ecdfc4, mc=0x6154a0, mc=0x6154a0) at mdb.c:8556 #1 0x0000000000405f10 in mdb_cursor_first (mc=0x6154a0, key=0x7fffffffe400, data=0x0) at mdb.c:7279 #2 0x00000000004060fc in mdb_cursor_next (mc=<optimized out>, key=<optimized out>, data=<optimized out>, op=<optimized out>) at mdb.c:6886 #3 0x0000000000404e35 in mdb_cursor_get (mc=0x6154a0, key=key@entry=0x7fffffffe400, data=data@entry=0x0, op=op@entry=MDB_NEXT_NODUP) at mdb.c:7466 #4 0x000000000040222f in main (argc=<optimized out>, argv=<optimized out>) at mdb_stat.c:230 (gdb) #mdb_copy -V LMDB 0.9.70: (December 19, 2015) Linux db0 3.13.0-95-generic XFS filesystem

2 2

Re: [EXT] Re: Is there any easy way to decode openldap logs
by chandan jain 12 Mar '21

12 Mar '21

Ok, thanks. Regards Chandan On Fri, Mar 12, 2021, 23:55 Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Friday, March 12, 2021 11:38 PM +0530 chandan jain > <chandandevops(a)gmail.com> wrote: > > > > > > > Quanah I'm waiting for your take on this as you are aware of the whole > > thread from start. > > I don't have anything to add at this point. I don't know what sort of > writes your application does, I don't know what it's requirements are as > far as doing reads after writes, etc. In general, I'd expect a well > written application that needs to do thousands of reads to be isolated > from > the write side of data processing, which doesn't seem to be the case here. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Re: [EXT] Re: Is there any easy way to decode openldap logs
by chandan jain 12 Mar '21

12 Mar '21

More server behind load balancer means more distribution of traffic and less load on a single node .Sudden spike in traffic won't choke the setup. Regards Chandan On Fri, Mar 12, 2021, 00:18 Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Friday, March 12, 2021 12:12 AM +0530 chandan jain > <chandandevops(a)gmail.com> wrote: > > > > > Quanah, I am already having this setup, but business wants to horizontal > > scale the setup. > > If you only have a single application using LDAP, how does horizontal > scaling help in any way? > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 3

Re: [EXT] Re: Is there any easy way to decode openldap logs
by chandan jain 11 Mar '21

11 Mar '21

Quanah, I am already having this setup, but business wants to horizontal scale the setup. As far as I understood, horizontal scaling is for reads replicas only, as writes would go to single node with sticky session. Your earlier solution was perfect for my use case, its just that I am confused at how to bifurcate read and write connections. Shall I use two separate connection string from single application for read and write traffic to same set of servers with different pools. Regards Chandan On Thu, Mar 11, 2021, 21:30 Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Thursday, March 11, 2021 10:56 AM +0530 chandan jain > <chandandevops(a)gmail.com> wrote: > > > > > > > OK, but if I put a single connection string, how below setup suggested by > > quanah will work. > > > > > > I have a single application which read as well as write to ldap. > > If you have only a single application using LDAP, just set up two nodes > with sticky failover and a single pool, since nothing else is using LDAP. > As has been said repeatedly, in general, an application that does writes > should use the same connection for reads. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

3 2

Re: Re: [EXT] Re: Is there any easy way to decode openldap logs
by chandan jain 11 Mar '21

11 Mar '21

Understood quanah, but I have a single app which performs both read and write. App is using single connection string for binding with ldap. So shall I use two separate connection string, one for read and one for write in the application code ? Also, as per the configuration setup suggested by you, how the replication need to be setup, I mean mirror mode across write pool members and another mirroring for read pool members from one of write pool member. Regards Chandan On Wed, Mar 10, 2021, 21:41 Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Wednesday, March 10, 2021 6:43 PM +0530 chandan jain > <chandandevops(a)gmail.com> wrote: > > > > > > > A load-balancer that is not doing round-robin (but some other policy, > > like response time or throughput) probably would be OK > > > > > > > > OK agreed with you, but above loadbalancer config doesn't solve problem > > of horizontal scaling and load balancing. > > > > > > In other words, is it possible to achieve a horizontally scalable, highly > > available and load balanced setup. > > You set up two pools in the load balancer > > Pool 1 -> For apps that only do reads, and handles load distribution in > whatever method you feel best. Example DNS: ldap.example.com > > Pool 2 -> For apps that write directly. Sticky session to a single > provider unless it goes offline. Example DNS: ldap-provider.example.com > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

3 4

Re: Is there any easy way to decode openldap logs
by chandan jain 10 Mar '21

10 Mar '21

Thanks quanah for detailed explanation you have sorted the confusion. I have last doubt that read and write bifurcation for ldap connection string is to be handled in application code . It has nothing to do on the ldap end. I mean I need to define ldap.example.com <http://ldap-read.example.com> as connection string for reads and ldap-provider.example.com for writes in the application code. Regards On Wed, Mar 10, 2021, 23:19 Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Wednesday, March 10, 2021 10:38 PM +0530 chandan jain > <chandandevops(a)gmail.com> wrote: > > > > > > > Understood quanah, but I have a single app which performs both read and > > write. App is using single connection string for binding with ldap. So > > shall I use two separate connection string, one for read and one for > > write in the application code ? > > If you look closely at my response, I noted that apps that do writes > should > use the same pool for reads. This is generally due to the fact most apps > I've run across do a read after write and may hit problems if the change > is > not there (i.e., due to replication delays). > > > Also, as per the configuration setup suggested by you, how the > > replication need to be setup, I mean mirror mode across write pool > > members and another mirroring for read pool members from one of write > > pool member. > > I don't understand this question. There's a single set of servers, say A, > B, C, D. There are two pools configured in the load balancer. The first > pool uses a sticky setting, and always points to a single server for write > ops (say A) unless its down, at which point it will fail over to the first > available server (say B). The second pool is for reads, and does whatever > algorithm you think best (say round robin), and bounces between A, B, C, D. > > What replication mechanism is in use has nothing to do with the load > balancer configuration. I would generally advise using delta-syncrepl > between nodes A, B, C D, all of which connect directly to one another and > don't interact directly with the load balancer at all. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Re: Is there any easy way to decode openldap logs
by chandan jain 10 Mar '21

10 Mar '21

Thanks, Mirror mode configuration cannot be horizontal scaled what I understood as writes are going to one of the node, and other act as an active standby. I want 2 or more nodes behind a load balancer which can share read/write load. A kind of active active setup. Regards Chandan Jain On Mon, Mar 8, 2021, 23:44 Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Sunday, March 7, 2021 8:39 PM +0530 chandan jain > <chandandevops(a)gmail.com> wrote: > > > > > > > Thanks, Quanah > > > > > > Is it possible to direct upgrade from 2.4.32 to latest version. > > If you (temporarily) stick with the same backend, and in this case, if > that > same backend is linked to the exact same version of BDB, yes. I.e., > compile the back-bdb/hdb backends against the same version of BDB, > upgrade, > and then migrate to back-mdb. > > > Also, can we horizontal scale a 2 node mirror mode setup? I am confused > > after seeing suggestions on different sites. > > I don't understand the question here. Mirror mode is just a configuration > of MMR with a load balancer in front. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

3 6

IdP in OpenLDAP
by Yeo Wee Tat (NCS) 10 Mar '21

10 Mar '21

Hi all May I know how to setup openLDAP as IdP in RedHat Entrepise 7.8 ? Any steps or documentations ? Thanks

1 0

Re: Is there any easy way to decode openldap logs
by chandan jain 10 Mar '21

10 Mar '21

OK, but how to spread out read traffic. I mean how I can bifurcate read and write go to different nodes. I mean how application decide which node to write and which node to read from. Regards Chandan On Wed, Mar 10, 2021, 00:02 Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Tuesday, March 9, 2021 3:28 PM +0530 chandan jain > <chandandevops(a)gmail.com> wrote: > > > > > > > Thanks, > > > > > > Mirror mode configuration cannot be horizontal scaled what I understood > > as writes are going to one of the node, and other act as an active > > standby. > > > > > > I want 2 or more nodes behind a load balancer which can share read/write > > load. A kind of active active setup. > > The point of mirror mode is that only one server in the pool gets writes. > You can horizontally scale that as much as you want, whether there are 2 > servers in the pool or 5000. I.e., as long as write traffic only goes to > one of those servers, you have mirror mode. > > Generally I would advise against distributing write traffic (i.e., do > exactly what mirror mode does, direct all write traffic to a single active > node unless it goes down and fail over is necessary). Spread out read > traffic as desired. > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Re: Is there any easy way to decode openldap logs
by chandan jain 09 Mar '21

09 Mar '21

Thanks, Quanah Is it possible to direct upgrade from 2.4.32 to latest version. Also, can we horizontal scale a 2 node mirror mode setup? I am confused after seeing suggestions on different sites. Regards Chandan Jain On Fri, Mar 5, 2021, 00:28 Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Thursday, March 4, 2021 11:49 PM +0530 chandan jain > <chandandevops(a)gmail.com> wrote: > > > > > It is openldap-2.4.32, i don't see any mdb support option while > > compiling . > > It is compiled with below options: > > > > > > tar -xzf db-5.3.21.tar.gz > > tar -zxf openldap-2.4.32.tgz > > cd db-5.3.21 > > cd build_unix/ > > ../dist/configure --enable-compat185 --enable-dbm --disable-static > > --enable-cxx && make && make install > > db_verify -V > > cd ../.. > > cd openldap-2.4.32 > > ./configure --prefix=/usr/local/OpenLDAP --with-tls=no > > --enable-modules=yes --enable-overlays=yes --enable-ppolicy=yes && make > > depend && make && make install > > 2.4.32 is over 8 years old. As I said, use a current release (2.4.57). > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

3 3

opinions on schema-checking
by A. Schulze 09 Mar '21

09 Mar '21

Hello, I'm running a LDAP provider and multiple LDAP consumer and like to ask for your opinions to such a setup: While writing data to the LDAP provider, schema-checking is enforced. Currently also the LDAP consumer enforce schema checking. Q: does it make sense to enforce schema checking on a LDAP consumer, too? What pros and cons do you see? Thanks! Andreas

5 10

ldap_modify: Other (e.g., implementation specific) error (80)
by Stefan Bauer 06 Mar '21

06 Mar '21

Hi, the internet is full of "tips" to solve the above problem. I'm pulling my hairs and can not find the real issue since days. any help is greatly appreciated. --------- enable_ssl.ldiff --------------- dn: cn=config changetype: modify add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ldap/key.key dn: cn=config changetype: modify add: olcTLSCertificateFile olcTLSCertificateFile: /etc/ldap/cert.pem --------- enable_ssl.ldiff --------------- # ls -alh /etc/ldap/cert.pem /etc/ldap/key.key -rwxrwxrwx 1 root root 1,1K Mär 1 21:43 /etc/ldap/cert.pem -rwxrwxrwx 1 root root 1,7K Mär 1 21:21 /etc/ldap/key.key # openssl rsa -noout -modulus -in /etc/ldap/key.key | openssl md5 (stdin)= 45b4165df200817a20857fb453acd33e # openssl x509 -noout -modulus -in /etc/ldap/cert.pem | openssl md5 (stdin)= 45b4165df200817a20857fb453acd33e # head -n2 /etc/ldap/cert.pem -----BEGIN CERTIFICATE----- MIIFmDCCBICgAwIBAgIQBFMR6HMGTGjQIjSj4sQX+TANBgkqhkiG9w0BAQsFADBu # head -n2 /etc/ldap/key.key -----BEGIN RSA PRIVATE KEY----- MIIEowIBAAKCAQEAvrDddMwXoy10diqDpqd45jaC8HiGKz7KC5X3W0ZLvCshylu0 ldapmodify -Y EXTERNAL -H ldapi:/// -f enable_ssl.ldif -v # ldapmodify -Y EXTERNAL -H ldapi:/// -f enable_ssl.ldif -v ldap_initialize( ldapi:///??base ) SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 add olcTLSCertificateKeyFile: /etc/ldap/key.key modifying entry "cn=config" ldap_modify: Other (e.g., implementation specific) error (80) I can however modify other values like *olcLogLevel* without problems. Debian 10 latest: 2.4.47+dfsg-3+deb10u6 # slapd -VVV @(#) $OpenLDAP: slapd (Feb 14 2021 18:32:34) $ Debian OpenLDAP Maintainers <pkg-openldap-devel(a)lists.alioth.debian.org> Included static backends: config ldif Stefan.

2 2

ACL for sync reader
by Frédéric Goudal 06 Mar '21

06 Mar '21

Hello, I have a production ldap with some acl set. For historical reason the synchronizationn is done with the root dn which is bad. I want to add a user to perform synchronization it must have the right to read everytthing. is the acl : access to * by dn.exact=<somedn> break added in first position be enough to read everything (even attributs that have been limited on some other acl) AND not break the current configuration ? Thanks in advance. f.g.

3 6

Re: Is there any easy way to decode openldap logs
by chandan jain 04 Mar '21

04 Mar '21

It is openldap-2.4.32, i don't see any mdb support option while compiling . It is compiled with below options: tar -xzf db-5.3.21.tar.gz tar -zxf openldap-2.4.32.tgz cd db-5.3.21 cd build_unix/ ../dist/configure --enable-compat185 --enable-dbm --disable-static --enable-cxx && make && make install db_verify -V cd ../.. cd openldap-2.4.32 ./configure --prefix=/usr/local/OpenLDAP --with-tls=no --enable-modules=yes --enable-overlays=yes --enable-ppolicy=yes && make depend && make && make install Regards Chandan On Thu, 4 Mar 2021 at 22:48, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Thursday, March 4, 2021 10:40 PM +0530 chandan jain > <chandandevops(a)gmail.com> wrote: > > > > > > > Thanks quanah, I will change log level to 256 to see the results. > > > > > > Also, is it possible to migrate from bdb to mdb, the ldap is mirror mode > > sync with 2 nodes and it is compiled version not a rpm one. > > Assuming it was built with back-mdb support, yes. I have no idea what > release you're running, but you'll want a current one. > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Re: Is there any easy way to decode openldap logs
by chandan jain 04 Mar '21

04 Mar '21

Thanks quanah, I will change log level to 256 to see the results. Also, is it possible to migrate from bdb to mdb, the ldap is mirror mode sync with 2 nodes and it is compiled version not a rpm one. Regards Chandan On Thu, Mar 4, 2021, 21:49 Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Thursday, March 4, 2021 12:00 PM +0530 chandan jain > <chandandevops(a)gmail.com> wrote: > > > > > Hi Techies, > > > > > > I am new to openLDAP, i am reading its log file. Is their any easy way to > > decode the logs to identify what is going on? > > I would suggest simply setting a loglevel of "stats". You're currently > going to suffer from information overload. > > I'd also note that the BDB backend is deprecated and is generally not > recommended for use. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Is there any easy way to decode openldap logs
by chandan jain 04 Mar '21

04 Mar '21

Hi Techies, I am new to openLDAP, i am reading its log file. Is their any easy way to decode the logs to identify what is going on? Please see below logs: Mar 3 03:22:01 myserver OpenLDAP[53304]: daemon: activity on 1 descriptor Mar 3 03:22:01 myserver OpenLDAP[53304]: daemon: activity on: Mar 3 03:22:01 myserver OpenLDAP[53304]: Mar 3 03:22:01 myserver OpenLDAP[53304]: slap_listener_activate(7): Mar 3 03:22:01 myserver OpenLDAP[53304]: daemon: epoll: listen=7 busy Mar 3 03:22:01 myserver OpenLDAP[53304]: >>> slap_listener(ldap:// 0.0.0.0:389) Mar 3 03:22:01 myserver OpenLDAP[53304]: daemon: listen=7, new connection on 19 Mar 3 03:22:01 myserver OpenLDAP[53304]: daemon: activity on 1 descriptor Mar 3 03:22:01 myserver OpenLDAP[53304]: daemon: activity on: Mar 3 03:22:01 myserver OpenLDAP[53304]: Mar 3 03:22:01 myserver OpenLDAP[53304]: daemon: added 19r (active) listener=(nil) Mar 3 03:22:01 myserver OpenLDAP[53304]: conn=103380 fd=19 ACCEPT from IP= 10.101.21.156:60358 (IP=0.0.0.0:389) Mar 3 03:22:01 myserver OpenLDAP[53304]: daemon: epoll: listen=7 active_threads=0 tvp=zero Mar 3 03:22:01 myserver OpenLDAP[53304]: daemon: activity on 2 descriptors Mar 3 03:22:01 myserver OpenLDAP[53304]: daemon: activity on: Mar 3 03:22:01 myserver OpenLDAP[53304]: 19r Mar 3 03:22:01 myserver OpenLDAP[53304]: Mar 3 03:22:01 myserver OpenLDAP[53304]: daemon: read active on 19 Mar 3 03:22:01 myserver OpenLDAP[53304]: daemon: epoll: listen=7 active_threads=0 tvp=zero Mar 3 03:22:01 myserver OpenLDAP[53304]: connection_get(19) Mar 3 03:22:01 myserver OpenLDAP[53304]: connection_get(19): got connid=103380 Mar 3 03:22:01 myserver OpenLDAP[53304]: connection_read(19): checking for input on id=103380 Mar 3 03:22:01 myserver OpenLDAP[53304]: op tag 0x60, time 1614759721 Mar 3 03:22:01 myserver OpenLDAP[53304]: conn=103380 op=0 do_bind Mar 3 03:22:01 myserver OpenLDAP[53304]: >>> dnPrettyNormal: <cn=Manager,dc=icma-web,dc=com> Mar 3 03:22:01 myserver OpenLDAP[53304]: daemon: activity on 1 descriptor Mar 3 03:22:01 myserver OpenLDAP[53304]: daemon: activity on: Mar 3 03:22:01 myserver OpenLDAP[53304]: <<< dnPrettyNormal: <cn=Manager,dc=icma-web,dc=com>, <cn=manager,dc=icma-web,dc=com> Mar 3 03:22:01 myserver OpenLDAP[53304]: conn=103380 op=0 BIND dn="cn=Manager,dc=icma-web,dc=com" method=128 Mar 3 03:22:01 myserver OpenLDAP[53304]: do_bind: version=3 dn="cn=Manager,dc=icma-web,dc=com" method=128 Mar 3 03:22:01 myserver OpenLDAP[53304]: daemon: epoll: listen=7 active_threads=0 tvp=zero Mar 3 03:22:01 myserver OpenLDAP[53304]: ==> bdb_bind: dn: cn=Manager,dc=icma-web,dc=com Mar 3 03:22:01 myserver OpenLDAP[53304]: conn=103380 op=0 BIND dn="cn=Manager,dc=icma-web,dc=com" mech=SIMPLE ssf=0 Mar 3 03:22:01 myserver OpenLDAP[53304]: do_bind: v3 bind: "cn=Manager,dc=icma-web,dc=com" to "cn=Manager,dc=icma-web,dc=com" Mar 3 03:22:01 myserver OpenLDAP[53304]: send_ldap_result: conn=103380 op=0 p=3 Mar 3 03:22:01 myserver OpenLDAP[53304]: send_ldap_result: err=0 matched="" text="" Mar 3 03:22:01 myserver OpenLDAP[53304]: send_ldap_response: msgid=1 tag=97 err=0 Mar 3 03:22:01 myserver OpenLDAP[53304]: conn=103380 op=0 RESULT tag=97 err=0 text= Mar 3 03:22:01 myserver OpenLDAP[53304]: daemon: activity on 1 descriptor Mar 3 03:22:01 myserver OpenLDAP[53304]: daemon: activity on: Mar 3 03:22:01 myserver OpenLDAP[53304]: 19r Mar 3 03:22:01 myserver OpenLDAP[53304]: Mar 3 03:22:01 myserver OpenLDAP[53304]: daemon: read active on 19 Mar 3 03:22:01 myserver OpenLDAP[53304]: daemon: epoll: listen=7 active_threads=0 tvp=zero Mar 3 03:22:01 myserver OpenLDAP[53304]: connection_get(19) Mar 3 03:22:01 myserver OpenLDAP[53304]: connection_get(19): got connid=103380 Mar 3 03:22:01 myserver OpenLDAP[53304]: connection_read(19): checking for input on id=103380 Mar 3 03:22:01 myserver OpenLDAP[53304]: op tag 0x63, time 1614759721 Mar 3 03:22:01 myserver OpenLDAP[53304]: conn=103380 op=1 do_search Mar 3 03:22:01 myserver OpenLDAP[53304]: >>> dnPrettyNormal: <dc=icma-web,dc=com> Mar 3 03:22:01 myserver OpenLDAP[53304]: <<< dnPrettyNormal: <dc=icma-web,dc=com>, <dc=icma-web,dc=com> Mar 3 03:22:01 myserver OpenLDAP[53304]: SRCH "dc=icma-web,dc=com" 2 0 Mar 3 03:22:01 myserver OpenLDAP[53304]: 0 0 0 Mar 3 03:22:01 myserver OpenLDAP[53304]: begin get_filter Mar 3 03:22:01 myserver OpenLDAP[53304]: EQUALITY Mar 3 03:22:01 myserver OpenLDAP[53304]: end get_filter 0 Mar 3 03:22:01 myserver OpenLDAP[53304]: filter: (uid=icma_emp_1emp113) Mar 3 03:22:01 myserver OpenLDAP[53304]: attrs: Mar 3 03:22:01 myserver OpenLDAP[53304]: Mar 3 03:22:01 myserver OpenLDAP[53304]: conn=103380 op=1 SRCH base="dc=icma-web,dc=com" scope=2 deref=0 filter="(uid=icma_emp_1emp113)" Mar 3 03:22:01 myserver OpenLDAP[53304]: => bdb_search Mar 3 03:22:01 myserver OpenLDAP[53304]: bdb_dn2entry("dc=icma-web,dc=com") Mar 3 03:22:01 myserver OpenLDAP[53304]: => access_allowed: search access to "dc=icma-web,dc=com" "entry" requested Mar 3 03:22:01 myserver OpenLDAP[53304]: <= root access granted Mar 3 03:22:01 myserver OpenLDAP[53304]: => access_allowed: search access granted by manage(=mwrscxd) Mar 3 03:22:01 myserver OpenLDAP[53304]: search_candidates: base="dc=icma-web,dc=com" (0x00000001) scope=2 Mar 3 03:22:01 myserver OpenLDAP[53304]: => bdb_dn2idl("dc=icma-web,dc=com") Mar 3 03:22:01 myserver OpenLDAP[53304]: => bdb_filter_candidates Mar 3 03:22:01 myserver OpenLDAP[53304]: #011AND Mar 3 03:22:01 myserver OpenLDAP[53304]: => bdb_list_candidates 0xa0 Mar 3 03:22:01 myserver OpenLDAP[53304]: => bdb_filter_candidates Mar 3 03:22:01 myserver OpenLDAP[53304]: #011OR Mar 3 03:22:01 myserver OpenLDAP[53304]: => bdb_list_candidates 0xa1 Mar 3 03:22:01 myserver OpenLDAP[53304]: => bdb_filter_candidates Mar 3 03:22:01 myserver OpenLDAP[53304]: #011EQUALITY Mar 3 03:22:01 myserver OpenLDAP[53304]: => bdb_equality_candidates (objectClass) Mar 3 03:22:01 myserver OpenLDAP[53304]: => key_read Mar 3 03:22:01 myserver OpenLDAP[53304]: bdb_idl_fetch_key: [b49d1940] Mar 3 03:22:01 myserver OpenLDAP[53304]: <= bdb_index_read: failed (-30988) Mar 3 03:22:01 myserver OpenLDAP[53304]: <= bdb_equality_candidates: id=0, first=0, last=0 Mar 3 03:22:01 myserver OpenLDAP[53304]: <= bdb_filter_candidates: id=0 first=0 last=0 Mar 3 03:22:01 myserver OpenLDAP[53304]: => bdb_filter_candidates Mar 3 03:22:01 myserver OpenLDAP[53304]: #011EQUALITY Mar 3 03:22:01 myserver OpenLDAP[53304]: => bdb_equality_candidates (uid) Mar 3 03:22:01 myserver OpenLDAP[53304]: => key_read Mar 3 03:22:01 myserver OpenLDAP[53304]: bdb_idl_fetch_key: [9a14f458] Mar 3 03:22:01 myserver OpenLDAP[53304]: <= bdb_index_read: failed (-30988) Mar 3 03:22:01 myserver OpenLDAP[53304]: <= bdb_equality_candidates: id=0, first=0, last=0 Mar 3 03:22:01 myserver OpenLDAP[53304]: <= bdb_filter_candidates: id=0 first=0 last=0 Mar 3 03:22:01 myserver OpenLDAP[53304]: <= bdb_list_candidates: id=0 first=0 last=0 Mar 3 03:22:01 myserver OpenLDAP[53304]: <= bdb_filter_candidates: id=0 first=0 last=0 Mar 3 03:22:01 myserver OpenLDAP[53304]: <= bdb_list_candidates: id=0 first=1 last=0 Mar 3 03:22:01 myserver OpenLDAP[53304]: <= bdb_filter_candidates: id=0 first=1 last=0 Mar 3 03:22:01 myserver OpenLDAP[53304]: bdb_search_candidates: id=0 first=1 last=0 Mar 3 03:22:01 myserver OpenLDAP[53304]: bdb_search: no candidates Mar 3 03:22:01 myserver OpenLDAP[53304]: send_ldap_result: conn=103380 op=1 p=3 Mar 3 03:22:01 myserver OpenLDAP[53304]: send_ldap_result: err=0 matched="" text="" Mar 3 03:22:01 myserver OpenLDAP[53304]: send_ldap_response: msgid=2 tag=101 err=0 Mar 3 03:22:01 myserver OpenLDAP[53304]: conn=103380 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Mar 3 03:22:01 myserver OpenLDAP[53304]: daemon: activity on 1 descriptor Mar 3 03:22:01 myserver OpenLDAP[53304]: daemon: activity on:

2 1

openldap client library connection caching?
by Rallavagu Kon 04 Mar '21

04 Mar '21

All, Deployed OpenLDAP 2.4 in production (with replication) mainly serving saslauthd and sendmail on Linux with client library 2.4.49. We are experiencing sporadic errors "ldap_simple_bind() failed -1 (Can't contact LDAP server).”. This issue happens on both saslauthd and on openldap when replicating to other service. However, upon investigation we have found that this error is not disruptive as both services (saslauthd and openldap server) have “retry” options built-in and subsequent request (immediately after a failure) receives successful response. Also, noticed that this issue manifests when communication occurs via ELB (AWS) and no connect issues were manifested when clients are directly pointed to openldap server (all connections are TLS). This makes me infer (suspect) that openldap client library might be caching (or tcp alive etc.) the connection which is not working well with ELB (Elastic Load Balancer). Wondering if the connection is really cached and is there a configuration parameter that I can try and tune the behavior (tried to chase this down looking into the source code of client library but could not locate it, perhaps I need to look more but wondering if someone else in the community has any experience in this regard). Thank You.

3 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical