- openldap-technical - openldap.org

LDAP Master/Slave replication
by asiani＠free.fr 05 Feb '08

05 Feb '08

The log : Feb 5 13:11:37 dev5 slapd[2523]: =>do_syncrepl Feb 5 13:11:37 dev5 slapd[2523]: => bdb_entry_get: ndn: "cn=syncrepl123,dc=myDomain,dc=com" Feb 5 13:11:37 dev5 slapd[2523]: => bdb_entry_get: oc: "(null)", at: "syncreplCookie" Feb 5 13:11:37 dev5 slapd[2523]: bdb_dn2entry("cn=syncrepl123,dc=myDomain,dc=com") Feb 5 13:11:37 dev5 slapd[2523]: => bdb_dn2id( "dc=myDomain,dc=com" ) Feb 5 13:11:37 dev5 slapd[2523]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30989) Feb 5 13:11:37 dev5 slapd[2523]: => bdb_entry_get: cannot find entry: "cn=syncrepl123,dc=myDomain,dc=com" Feb 5 13:11:37 dev5 slapd[2523]: =>do_syncrep2 thanks for you help ! Alain Hello, I use the bottom file "slapd.conf" to mirror master server. It was ok with 2.2.23-5 version of openldap. I just installed a new version of openldap : 2.3.27-8 Now the slave server start ok... but slapcat is empty !!?? Do you have an idea ? Thanks a lot, Alain slapd.conf _________ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema allow bind_v2 pidfile /var/run/slapd.pid argsfile /var/run/slapd.args loglevel 256 database bdb suffix "dc=myDomain,dc=com" rootdn "cn=Manager,dc=myDomain,dc=com" rootpw {SSHA}wuapktMrH50PDG29WoffJcmvpblebsdT directory /var/lib/ldap/myDomain.com index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryUUID eq access to * by * read syncrepl rid=123 provider=ldap://10.0.0.242:389 type=refreshOnly interval=00:00:01:00 searchbase="dc=myDomain,dc=com" filter="(objectclass=*)" attrs="*" scope=sub bindmethod=simple binddn="cn=Manager,dc=myDomain,dc=com" credentials="myPassword"

1 0

LDAP Master/Slave replication
by asiani＠free.fr 05 Feb '08

05 Feb '08

Hello, I use the bottom file "slapd.conf" to mirror master server. It was ok with 2.2.23-5 version of openldap. I just installed a new version of openldap : 2.3.27-8 Now the slave server start ok... but slapcat is empty !!?? Do you have an idea ? Thanks a lot, Alain slapd.conf _________ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema allow bind_v2 pidfile /var/run/slapd.pid argsfile /var/run/slapd.args loglevel 256 database bdb suffix "dc=myDomain,dc=com" rootdn "cn=Manager,dc=myDomain,dc=com" rootpw {SSHA}wuapktMrH50PDG29WoffJcmvpblebsdT directory /var/lib/ldap/myDomain.com index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryUUID eq access to * by * read syncrepl rid=123 provider=ldap://10.0.0.242:389 type=refreshOnly interval=00:00:01:00 searchbase="dc=myDomain,dc=com" filter="(objectclass=*)" attrs="*" scope=sub bindmethod=simple binddn="cn=Manager,dc=myDomain,dc=com" credentials="myPassword"

1 0

Exporting LDAP info from Active Directory / Exchange Global Address List
by Clemson, Chris (IHG) 04 Feb '08

04 Feb '08

Hi everyone, Hopefully I'm now sending this to the right list, apologies if not.... I am trying to find a way of exporting most information from the GAL into an LDAP server. It seems that OpenLDAP might do what I want, however I'm relatively new to using LDAP, so I was wondering if someone could give me a few pointers on how to do this. It sounds like I need to use a slapd as a Proxy Cache Engine, so I can cache an AD query (preferably the equivalent of the Exchange GAL) into OpenLDAP. People can then use the OpenLDAP server as a Directory source in Outlook without needing to log in to anything. I need to do something like this so that people who do not have access to the Exchange Servers can see (and therefore email) accounts in Exchange. I have found some mailing list articles that allude to this, but nothing specific. Thank you, Chris

2 2

Getent fonction with ldap
by asiani＠free.fr 04 Feb '08

04 Feb '08

Hello, I'm looking for a documentation of "howto configure getent with ldap", can you help me, i have problem with this fonction on centos 4.4 i can't get entries from ldap but i try to configure : /etc/pam.d/system-auth /etc/ldap.conf slapcat is ok i do : smbpasswd -w mypassword i put my conf at the bottom of this email, thanks for your help ! Alain /etc/pam.d/system-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. # Modif by AS auth required /lib/security/$ISA/pam_env.so auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass auth required /lib/security/$ISA/pam_deny.so account required /lib/security/$ISA/pam_unix.so account sufficient /lib/security/$ISA/pam_succeed_if.so uid < 100 quiet account required /lib/security/$ISA/pam_permit.so account sufficient /lib/security/$ISA/pam_ldap.so password requisite /lib/security/$ISA/pam_cracklib.so retry=3 password sufficient /lib/security/$ISA/pam_unix.so nullok use_authtok md5 shadow password required /lib/security/$ISA/pam_deny.so password sufficient /lib/security/$ISA/pam_ldap.so use_authtok session required /lib/security/$ISA/pam_limits.so session required /lib/security/$ISA/pam_unix.so session optional /lib/security/$ISA/pam_ldap.so /etc/ldap.conf host 127.0.0.1 #host 10.0.0.245 base dc=myDomain,dc=com rootbinddn cn=Manager,dc=myDomain,dc=com timelimit 120 bind_timelimit 120 idle_timelimit 3600 ssl no tls_cacertdir /etc/openldap/cacerts pam_password md5

2 3

password-hashing scheme
by Vinh.CTR.Hoang＠faa.gov 02 Feb '08

02 Feb '08

Hi, I'm have trouble trying to get a ldap client be authenicated by the the ldap server. I think the problem is that I might have the hash scheme configured wrongly or something like that. I'm on solaris 9 with Openldap 2.3.35. I have the password set as "clear" in the ldap.conf and password-hash as {MD5} in slapd.conf. Am I safe to assume that with these settings, it means that the client will be sent the passwords over the server as clear text and the server will hash it to MD5 before checking against its stored password list? If it is not the case, then how should I configure the client and server to be the case? Thanks, Vinh

4 5

Best method to set access permissions to third parties application with LDAP
by Benjamin Watine 01 Feb '08

01 Feb '08

Hello the list, I have to use LDAP to define access permissions for many third parties applications. So, I wonder what is the best way to organize my LDAP tree. I see two possibilities : - Set a LDAP group for each access level of each application, and create users that belongs to those groups. ex : GlobalServiceGroup | |__Application1Group | |__guestGroup | | |__user1 | | |__user2 | |__userGroup | | |__user3 | | |__user4 | |__adminGroup | |__Application2Group |__devTeamGroup | |__user1 | |__user2 | |__user3 | |__user4 |__testTeamGroup |__adminTeamGroup The problem of this solution is that I have to set a lot of groups, so my LDAP tree would became very complex to administrate. - Another way would be to define my own LDAP classes, with an attribute for each application that define the access level (guest, user, admin, etc). The problem of this solution is that I'm not anymore in the standard LDAP schema, and loose interoperability with standards LDAP clients. What is the best way to set that. Is there is another possibility than the two I mentioned before ? Thank you ! Ben

3 2

Re: Export / import ldap database between 2.2.29 & 2.3.27
by asiani＠free.fr 01 Feb '08

01 Feb '08

Ok thanks a lot !!!!! It is working now ! thks, Alain Buchan Milne wrote: > On Friday 01 February 2008 13:59:11 asiani(a)free.fr wrote: > >> # tail -n106 fichier_slapcat.ldif|head -n30 >> > > Now run this on both the old and the new server: > > # grep ^include /etc/openldap/slapd.conf > > It looks like your new server is missing inetorgperson.schema, and probably > many more. You should add the missing include lines to slapd.conf on your new > server, and try import again. > > Regards, > Buchan > >

1 0

Export / import ldap database between 2.2.29 & 2.3.27
by asiani＠free.fr 01 Feb '08

01 Feb '08

Hello, My source server : openldap-clients-2.2.29-1.FC3 perl-Net-LDAP-0.3202-1.1.fc3.rf nss_ldap-220-3 openldap-devel-2.2.29-1.FC3 php-ldap-4.3.11-2.8.4.legacy smbldap-tools-0.9.1-1.1.fc3.rf openldap-2.2.29-1.FC3 openldap-servers-2.2.29-1.FC3 My destination server : openldap-2.3.27-8 openldap-devel-2.3.27-8 perl-LDAP-0.33-3.fc6 php-ldap-5.1.6-15.el5 python-ldap-2.2.0-2.1 nss_ldap-253-5.el5 openldap-servers-2.3.27-8 I export my database from source : ldapsearch -LLL -x -h localhost -D "cn=Manager,dc=myDomain,dc=com" -w password -b "dc=myDomain,dc=com" > /backups/ldap/ldap-fs4-$TODAY.ldif dn: dc=myDomain,dc=com objectClass: dcObject objectClass: organization o: myDomain dc: myDomain dn: ou=Users,dc=myDomain,dc=com objectClass: organizationalUnit ou: Users dn: ou=Groups,dc=myDomain,dc=com objectClass: organizationalUnit ou: Groups dn: ou=Computers,dc=myDomain,dc=com objectClass: organizationalUnit ou: Computers dn: cn=NextFreeUnixId,dc=myDomain,dc=com objectClass: inetOrgPerson objectClass: sambaUnixIdPool cn: NextFreeUnixId sn: NextFreeUnixId gidNumber: 1001 uidNumber: 1154 dn: uid=smbguest3,ou=Users,dc=myDomain,dc=com objectClass: inetOrgPerson objectClass: sambaSamAccount objectClass: posixAccount objectClass: shadowAccount (...) and try to add in my destination server : slapadd -l fichier.ldif The system failed with this error : str2entry: invalid value for attributeType objectClass #1 (syntax 1.3.6.1.4.1.1466.115.121.1.38) slapadd: could not parse entry (line=69) The database is working well on source server...do y have an idea ? Thank you very much ! Alain

3 3

Pagination behavior using ldap_ctrl_paged
by Faraz R. Khan 01 Feb '08

01 Feb '08

Hi, Is there anyway I can navigate back and forth using the paged results control? The only thing I can currently use is going forward a certain pageSize. I realize this is exactly as per the RFC (2696) but is there anyway I can achieve back and forth pagination (pageSize = -3 for example)? Thank you. -- Faraz R Khan Chief Architect Emergen Consulting Pvt Ltd www.emergen.biz

2 1

ldap_search_ext_s: maximum no of entries
by Rakesh Yadav 31 Jan '08

31 Jan '08

Hi, In case of ldap_search_ext_s: We can pass,how many entries we want. In my case i can retrieve only 100 entries at a time due to the size limit of my buffer. But the ldap search which i am using will return 1000 entries. Is there any way through which i can retrieve 1000 entries in chunks of 100. first time i will fetch 100 entries then again next 100 entries then again next 100 entries..... ... ... In this way i will retrieve all the entries. Please tell me the way of fetching entries from LDAP. -- Thanks Rakesh Yadav

6 8

Please Help
by Umar Draz 31 Jan '08

31 Jan '08

Dear Members! I recently installed openldap and running successfully but there is some lines i saw in ldap log file. bdb_equality_candidates: (memberUid) not indexed bdb_equality_candidates: (sambaDomainName) not indexed Please help what is this and how i can fix that Kind Rgards, Umar Draz --------------------------------- Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now.

1 0

OpenLDAP Log format
by Gustavo Mendes de Carvalho 31 Jan '08

31 Jan '08

Hi there, I would like to know where can I find some document describing all fields and other informations about openldap log file and replication log file (slurp and syncrepl). Thanks in advance --- Gustavo Mendes de Carvalho e-mail: gmcarvalho(a)gmail.com

1 0

loglevel - ip client in logfile
by Christophe Dumonet 31 Jan '08

31 Jan '08

Hello from france, My question is about logs and so loglevel parameter for openldap 2.0 ( yes, this is and older version...! migration is in progress...) Basically, I want my logs contains IPs clients to do some tuning because of some CPU overloads occures while we are installing a new RADIUS client for this LDAP server. So I try to change my loglevel ( as describe here http://www.zytrax.com/books/ldap/ch6/#loglevel ) and no IP appears in logfile while loglevel is set to -1 (or whatever number). Is it possible ? Is my openldap version too old ? Is there other things to do ? Thanks, any help would be appreciate ! Christophe Dumonet. -- ---------------------------------------------------- Christophe Dumonet Centre de Ressources Informatiques Institut Francais de Mecanique Avancee (IFMA) Campus des Cezeaux BP 265 63175 AUBIERE Cedex Tel : +33 - 4.73.28.80.64 Fax : +33 - 4.73.28.81.00 Mail : Christophe.Dumonet(a)ifma.fr ----------------------------------------------------

1 0

Can't contact LDAP Server
by shanmuga priya 30 Jan '08

30 Jan '08

hello all, I was following the documentation to setup openLDAP stuff - http://www.jukie.net/~bart/ldap/ldap-authentication-on-debian/<http://www.jukie.net/%7Ebart/ldap/ldap-authentication-on-debian/> I've modified the ldap.conf and slapd.conf accordingly. But when I tried for testing by doing: ldapsearch -x -W -D 'cn=admin,dc=example' 'objectClass=*' I got the following message: Can't contact LDAP Server How to overcome this problem?? -- Future is now..

4 4

Querying for olcDatabase parameters
by Josh Miller 30 Jan '08

30 Jan '08

Good morning, What is the trick to querying cn=config for olcDatabase entries? I am running OpenLDAP 2.4.7 with a full directory, converted from slapd.conf to slapd.d and everything seems to be running just fine. I can query the directory and I get back all of the entries that I would expect to find. I have renamed my slapd.conf file to ensure that I am not relying upon it, yet I don't see any olcDatabase entries when I query cn=config: [:user@host:] ldapsearch -x -H ldap://localhost/ -D "cn=config" -b 'cn=config' -W cn=config -LLL Enter LDAP Password: dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /etc/openldap/slapd.conf olcConfigDir: /etc/openldap/slapd.d olcArgsFile: /var/run/openldap/run/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcLocalSSF: 71 olcLogLevel: 256 olcPidFile: /var/run/openldap/run/slapd.pid olcReadOnly: FALSE olcSaslSecProps: noplain,noanonymous olcSecurity: ssf=128 olcSecurity: tls=128 olcSecurity: update_ssf=128 olcSecurity: update_tls=128 olcSecurity: simple_bind=128 olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCACertificateFile: /usr/share/ssl/certs/posca3.crt olcTLSCertificateFile: /etc/pki/tls/certs/host.crt olcTLSCertificateKeyFile: /etc/pki/tls/certs/host.key olcTLSCipherSuite: HIGH:MEDIUM:+SSLv2:RSA olcTLSCRLCheck: none olcTLSVerifyClient: never olcToolThreads: 1 [:user@host:] ll /etc/openldap/slapd.d/cn\=config total 64 -rw------- 1 ldap ldap 398 Jan 10 13:22 cn=module{0}.ldif drwxr-x--- 2 ldap ldap 4096 Jan 10 13:22 cn=schema -rw------- 1 ldap ldap 38702 Jan 10 13:22 cn=schema.ldif -rw------- 1 ldap ldap 1163 Jan 10 13:22 olcDatabase={0}config.ldif drwxr-x--- 2 ldap ldap 4096 Jan 10 13:22 olcDatabase={1}bdb -rw------- 1 ldap ldap 2827 Jan 10 13:22 olcDatabase={1}bdb.ldif -rw------- 1 ldap ldap 1236 Jan 10 13:22 olcDatabase={-1}frontend.ldif TIA, -- Joshua M. Miller - RHCE,VCP

1 1

SSL/TLS connection on port 389
by Chris Carr 30 Jan '08

30 Jan '08

Hi All, I've been running slapd with "-h ldaps:///" so that it takes SSL/TLS connections on port 636. This has worked with most clients (Outlook, Seamonkey, Thunderbird) but does not work for Evolution. I don't know why not, but Evolution seems to insist on using port 389 for secure connections. When I type openssl s_client -connect my.server.com:389 It says connection refused. When I type the same command with :636 at the end it connects fine. Could somebody explain to me how to tell slapd to accept secure connections on port 389? I am using the new version of slapd in Debian Testing (2.4.7-1). Sorry if this is a really stupid question, but according to the docs the "startTLS" process should be automatic if a secure connection comes in on port 389. Something is obviously not quite right. Thanks in advance, Chris This e-mail may contain information which is confidential, legally privileged and/or copyright protected. This e-mail is intended for the addressee only. If you receive this in error, please contact the sender and delete the material from your computer

7 15

only ET_DYN and ET_EXEC can be loaded
by Pat Riehecky 30 Jan '08

30 Jan '08

When I started up my test slapd today I got the following message (along with a bunch of normal stuff): line 41 (moduleload smbk5pwd) lt_dlopenext failed: (smbk5pwd) /usr/lib/ldap/smbk5pwd.so.0: only ET_DYN and ET_EXEC can be loaded /etc/ldap/slapd.conf: line 41: <moduleload> handler exited with 1! What on earth does this mean? I spent some time on google to no avail. I know it doesn't like my .so.0 but (a) what doesn't it like and (b) how do I fix it? Pat

3 3

OpenLDAP and Solaris 10 - group problem
by Kick, Claus 29 Jan '08

29 Jan '08

Hello everyone, we are trying to use OpenLDAP to provide user management for a CMS. The CMS relies on OS groups to manage directory branch- and file-access. We are using the following group structure: dn: cn=ts_de_de_gg_ax, ou=Group, o=********** gidNumber: 1400 memberUid: uid=tsmaster, ou=People, o=********** memberUid: uid=teamsite, ou=People, o=********** memberUid: uid=ostehov9, ou=People, o=********** memberUid: uid=zenksid3, ou=People, o=********** memberUid: uid=lellirdg, ou=People, o=********** memberUid: uid=osteholdap, ou=People, o=********** objectClass: posixGroup objectClass: top cn: ts_de_de_gg_ax a user looks like this: dn: uid=osteholdap, ou=People, o=********* sn: osteholdap userPassword:: ********* loginShell: /bin/bash uidNumber: 3618 gidNumber: 504 mail: ****** objectClass: top objectClass: person objectClass: posixAccount objectClass: shadowAccount objectClass: teamsiteinfo objectClass: inetOrgPerson uid: osteholdap tcgid: Z000E58C gecos: *********** teamsiteuserrole: tsuser shadowLastChange: 11111 cn: ******* homeDirectory: /tmp However, it is not possible for a user to access directories belonging to a secondary group he belongs to. What could be the issue here? I would be very grateful for a pointer into the right direction. Regards, Claus Kick

3 4

Uniqueness of entryUUID across multiple LDAP servers
by Rakesh Yadav 29 Jan '08

29 Jan '08

Hi, Actually i am using multiple LDAP servers due to distributed environment. So our tree hierarchy can span over multiple LDAP servers. And i want to use entryUUID as a unique key for my entries of the tree. Can u tell me,entryUUID would be unique over multiple LDAP servers? Or in case of multiple LDAP servers, Two entries which are residing on different LDAP servers but belongs to the same Tree Hierarchy, can have same entryUUID? Regards Rakesh Yadav On Jan 25, 2008 10:36 PM, Michael Ströder <michael(a)stroeder.com> wrote: > Rakesh Yadav wrote: > > > > I got your idea about entryUUID, but can u give me some idea about how > > can i retrieve the value of entryUUID for each entry if it is supported > > by LDAP system. > > Since it's an operational attribute it is not returned by default from > OpenLDAP. You have to explicitly request it or request all operational > attributes with +. > > Example (lines might be wrapped): > ldapsearch -b "dc=stroeder,dc=de" -s base "(objectClass=*)" "*" entryUUID > > or > > ldapsearch -b "dc=stroeder,dc=de" -s base "(objectClass=*)" "*" + > > Ciao, Michael. > --

2 1

OpenLDAP+Active Directory
by Aiko Barz 28 Jan '08

28 Jan '08

Hello, is it possible to create an Active Directory forest with multible subdomains and make those informations available for one Linux machine? Right now, we have one domain and it is possible to do authentication against the Active Directory, while using OpenLDAP, PAM and Kerberos. But now, another department would like to have its own directory/sub-domain. This means: uid=xyz will be located on different directory servers within the Active Directory forest. That means, there are UIDs with different BASEDNs. CN=userA,OU=Users,DC=example,DC=local from AD1 and CN=userB,OU=Users,DC=sub,DC=example,DC=local from AD2 shall both be able to access a Linux box via SSH. No problem? Regards, Aiko -- :wq

4 7

RE: [SPAM] - Re: Syncrepl multimaster replication issue - Sending mail server found on zen.spamhaus.org
by Penza Kenneth at MITTS 28 Jan '08

28 Jan '08

Tonni, Thanks very much for your help. I have removed the compiled version of openldap (it was failing in 4 test in make test) and installed the packages from http://staff.telkomsa.net/packages. The tests worked without any issues and managed to configure openldap using syncrepl. Thanks for the help provided Kenneth Penza -----Original Message----- From: openldap-technical-bounces+kenneth.penza=gov.mt(a)openldap.org [mailto:openldap-technical-bounces+kenneth.penza=gov.mt@openldap.org] On Behalf Of Tony Earnshaw Sent: 24 January 2008 07:34 Cc: openldap-technical(a)openldap.org Subject: [SPAM] - Re: Syncrepl multimaster replication issue - Sending mail server found on zen.spamhaus.org Penza Kenneth at MITTS skrev, on 23-01-2008 11:06: > I am currently trying to setup a multi-master ldap setup. > The setup is running on CentOS 5.1 with kernel 2.6.18-53.el5. In this > setup I have migrated the UNIX authentication files using MigrationTools > and everything worked fine. When I am trying to setup the replication I > am encountering a strange behavior. The initial synchronization was > performed by copying /var/lib/ldap directory when openldap was shutdown. > On starting both nodes query each other and everything seems operating > correctly. When I perform a change on either node, the node performs the > local change however it is not propagated on the other node and in the > /var/log/ldap.log I get the following message: > > > > When ever the change is made on ldap1 it reports: > > Jan 23 10:10:43 ldap1 slapd[5787]: null_callback : error code 0x10 > > Jan 23 10:10:43 ldap1 slapd[5787]: syncrepl_updateCookie: rid=002 > be_modify failed (16) Apart from what Gavin writes, since you're using CentOS5.1, consider using Buchan Milne's Red Hat RHEL5 rpms or src rpm at http://staff.telkomsa.net/packages/. He's done an awful lot of work (has done for years) and patched things that need patching (apart from anything else db4.6) which should ensure things working out of the box on your system. Best, --Tonni -- Tony Earnshaw Email: tonni at hetnet dot nl

1 0

Read/Write locks for LDAP entry
by Rakesh Yadav 28 Jan '08

28 Jan '08

Hi, Actually i want to know whether we can acquire any kind of lock in openLDAP for entries. Suppose we read some entry and use this for doing some calculation and at the same time someone else modify this entry, so i want to know that LDAP provides any kind of lock just like RDBMS. In case of RDBMS we can acquire lock over any record so nobody can modify this until we release this lock. Please tell me about the locking mechanism in OpenLDAP. Thanks -- Rakesh Yadav Pune.

2 3

RFC 2307 and me
by Sean Myers 28 Jan '08

28 Jan '08

I'm currently using an LDAP directory to do a few jobs, including acting as a Network Information Server in a POSIX environment (Debian Linux) via libnss-ldap. It's working great, with authentication handled by Kerberos...simple and elegant SSO. The question I have about RFC 2307, though, stems from a few applications that I've encountered along the way that don't really do things in a POSIX way, and while they can sift through my "people" ou just fine with filters I provide, they generally want my groups to act like a groupOfNames entry, with full DN member attributeTypes, insead of the POSIX uid alone. Are the applications that I'm using simply being unreasonably inflexible? If so, they're all open-source and adding in support to do things the RFC 2307 POSIX way as well as the RFC 2256 groupOfNames way is not an unthinkably difficult task. My initial feeling on this is that not everything is POSIX compatible, not everything should be POSIX compatible, and it might be useful for me and others to be able to abandon RFC 2307 for defining groups in favor of RFC 2256, which appears to be the more "LDAP/X.500" way of doing things. I'm using this directory for a few services, and Linux NSS is really the only POSIX user in the bunch, so would it be "right" to instead fork and libnss-ldap to support RFC 2256 for my implementation? If so, has this been done already? Looking for input before I violate established best practice, and apologies if I've failed at searching. Thanks. -- Sean Myers System Administrator American Research Institute (919) 228-4961

2 1

openldap tls with a ca
by Dave 27 Jan '08

27 Jan '08

Hello, I'm trying to set up openldap for network authentication of both FreeBSD and Linux machines as well as integrating a samba pdc. I've created a ca with instructions found at: http://sial.org/howto/openssl/ca/ I've added the appropriate options to slapd.conf, for TLS as i don't want passwords going around in the clear. Slapd starts fine with tls options added, but if i do an ldapsearch -Z i get a can not contact ldap server. ldapsearch: # extended LDIF # # LDAPv3 # base <dc=davemehler,dc=com> (default) with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 13 Confidentiality required text: confidentiality required # numResponses: 1 I assume this is normal, but the below is what i'm getting with ldapsearch -Z ldapsearch -Z: ldap_start_tls: Connect error (-11) ldap_result: Can't contact LDAP server (-1) Here are the tls options i'm using: slapd.conf: security ssf=128 TLSCipherSuite HIGH TLSCertificateFile /usr/local/etc/openldap/tls/ldap.davemehler.com.crt TLSCertificateKeyFile /usr/local/etc/openldap/tls/ldap.davemehler.com.key TLSCACertificateFile /usr/local/etc/openldap/tls/ca-cert.pem #TLSDHParamFile I'm not sure what that last file is or how to make it, is it critical? /usr/local/etc/ldap.conf: ssl start_tls tls_cacert /usr/local/etc/openldap/tls/ca-cert.pem Checking /var/log/debug.log i'm seeing an error confidentiality required, as if ldap can't read the key, but as i said it's mode 644. Here's the complete transaction: Jan 27 15:20:04 ldap slapd[73647]: conn=6 fd=10 ACCEPT from IP=192.168.0.203:51704 (IP=0.0.0.0:389) Jan 27 15:20:04 ldap slapd[73647]: conn=6 op=0 BIND dn="" method=128 Jan 27 15:20:04 ldap slapd[73647]: conn=6 op=0 RESULT tag=97 err=0 text= Jan 27 15:20:04 ldap slapd[73647]: conn=6 op=1 SRCH base="dc=davemehler,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup))" Jan 27 15:20:04 ldap slapd[73647]: conn=6 op=1 SRCH attr=cn userPassword memberUid uniqueMember gidNumber Jan 27 15:20:04 ldap slapd[73647]: conn=6 op=1 SEARCH RESULT tag=101 err=13 nentries=0 text=confidentiality required Jan 27 15:20:04 ldap slapd[73647]: conn=6 fd=10 closed (connection lost) Any help appreciated. Thanks. Dave.

2 1

Unique id for each ldap entry
by Rakesh Yadav 25 Jan '08

25 Jan '08

Hi, I want to get unique ids for each ldap entry, but i don't know whether ldap provides unique id for each entry or not. In case of RDBMS each entry(tuple) has a OID(Object id) through which we can access uniquely this Entry. In case of LDAP, i need such (OID) kind of object identifier. Please tell me whether ldap provides some kind of unique id(Other than DN) for it's entries or not. If yes then please tell me how we can get these unique ids? -- Rakesh Yadav Pune.

3 4

migrating to another server - restore problem - slapcat slapadd
by Christophe Dumonet 24 Jan '08

24 Jan '08

Hello, I'm migrating from an old openldap server to a new one. So, I have done a dump of the ldap database with a " slapcat -l mydump.ldap -f /etc/openldap/slapd.conf -b "dc=mycompany,dc=com" --> So I had a dump ldif file where organisational units and dn are not in hierarchical order. In my new server ( which works fine , I can ldapadd some ou,dn , no problem) --> The slapadd command doesn't work because my ldap data in the ldif file is not in hierarchical order. I can't re-order manually this because it's a important database ( the ldif --> 50Mo). My slapadd command to restore is : slapadd -l mydump.ldif -f /etc/openldap/slapd.conf -b "dc=mycompany,dc=com" and the errors are relative to the ldif OU order, I had trying to cut/paste in the ldif file some OUs to reorder and errors are reporting to another OUs...which are not in hierachical order ! How can I do to restore quickly my data to my new server ? Any help would be appreciated, Christophe Dumonet, From france -- ---------------------------------------------------- Christophe Dumonet Centre de Ressources Informatiques Institut Francais de Mecanique Avancee (IFMA) Campus des Cezeaux BP 265 63175 AUBIERE Cedex Tel : +33 - 4.73.28.80.64 Fax : +33 - 4.73.28.81.00 Mail : Christophe.Dumonet(a)ifma.fr ----------------------------------------------------

4 6

Syncrepl multimaster replication issue
by Penza Kenneth at MITTS 24 Jan '08

24 Jan '08

People, I am currently trying to setup a multi-master ldap setup. The setup is running on CentOS 5.1 with kernel 2.6.18-53.el5. In this setup I have migrated the UNIX authentication files using MigrationTools and everything worked fine. When I am trying to setup the replication I am encountering a strange behavior. The initial synchronization was performed by copying /var/lib/ldap directory when openldap was shutdown. On starting both nodes query each other and everything seems operating correctly. When I perform a change on either node, the node performs the local change however it is not propagated on the other node and in the /var/log/ldap.log I get the following message: When ever the change is made on ldap1 it reports: Jan 23 10:10:43 ldap1 slapd[5787]: null_callback : error code 0x10 Jan 23 10:10:43 ldap1 slapd[5787]: syncrepl_updateCookie: rid=002 be_modify failed (16) When ever the change is made on ldap2 it reports: Jan 23 10:40:31 ldap2 slapd[5677]: null_callback : error code 0x10 Jan 23 10:40:31 ldap2 slapd[5677]: syncrepl_updateCookie: rid=002 be_modify failed (16) Setup details: cd /root/ldap_inst tar xvzf db-4.6.21.tar.gz tar xvzf openldap-2.4.7.tgz cd db-4.6.21 cd build_unix/ ../dist/configure --prefix=/usr make clean (as root) make (as root) cd /usr/share/libtool/libltdl configure --prefix=/usr make make install (as root) cd /root/ldap_install/openldap-2.4.7 ./configure --prefix=/usrd /usr/share/libtool/libltdl./configure --prefix=/usr --sysconfdir=/etc --libexecdir=/usr/sbin --mandir=/usr/share/man --with-tls --without-cyrus-sasl -enable-modules -enable-bdb=mod -enable-hdb=mod -enable-ldap=mod --enable-crypt make depend make make install (as root) This procedure was completed on two nodes, namely ldap1 and ldap2. This slapd.conf of each nodes is as follows: Ldap1: cat /etc/openldap/slapd.conf | grep -v ^# | grep -v ^$ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/misc.schema allow bind_v2 pidfile /var/run/slapd.pid argsfile /var/run/slapd.args modulepath /usr/sbin/openldap moduleload back_bdb.la TLSCipherSuite HIGH:MEDIUM:+TLSv1:+SSLv2:+SSLv3 TLSCACertificateFile /etc/openldap/cacert.pem TLSCertificateFile /etc/openldap/slapd-cert-ldap1.pem TLSCertificateKeyFile /etc/openldap/slapd-key-ldap1.pem serverID 1 ldap://ldap1:389/ serverID 2 ldap://ldap2:389/ database bdb suffix "dc=linuxldap,dc=org" rootdn "cn=Manager,dc=linuxldap,dc=org" rootpw secret directory /var/lib/ldap checkpoint 128 15 cachesize 10000 dncachesize 5000 idlcachesize 30000 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 index objectClass,entryUUID,entryCSN eq #syncRepl rid=001 # provider=ldap://ldap1:389 # binddn="cn=Manager,dc=linuxldap,dc=org" # bindmethod=simple # credentials=secret # searchbase="dc=linuxldap,dc=org" # type=refreshOnly # interval=00:00:00:05 # retry="5 5 300 5" # timeout=1 syncRepl rid=002 provider=ldap://ldap2:389 binddn="cn=Manager,dc=linuxldap,dc=org" bindmethod=simple credentials=secret searchbase="dc=linuxldap,dc=org" type=refreshOnly interval=00:00:00:05 retry="5 5 300 5" timeout=1 mirrormode true sockbuf_max_incoming 5000 sockbuf_max_incoming_auth 5000 database monitor Ldap2: cat /etc/openldap/slapd.conf | grep -v ^# | grep -v ^$ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/misc.schema allow bind_v2 pidfile /var/run/slapd.pid argsfile /var/run/slapd.args modulepath /usr/sbin/openldap moduleload back_bdb.la TLSCipherSuite HIGH:MEDIUM:+TLSv1:+SSLv2:+SSLv3 TLSCACertificateFile /etc/openldap/cacert.pem TLSCertificateFile /etc/openldap/slapd-cert-ldap1.pem TLSCertificateKeyFile /etc/openldap/slapd-key-ldap1.pem serverID 1 ldap://ldap1:389/ serverID 2 ldap://ldap2:389/ database bdb suffix "dc=linuxldap,dc=org" rootdn "cn=Manager,dc=linuxldap,dc=org" rootpw secret directory /var/lib/ldap checkpoint 128 15 cachesize 10000 dncachesize 5000 idlcachesize 30000 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 index objectClass,entryUUID,entryCSN eq syncRepl rid=001 provider=ldap://ldap1:389 binddn="cn=Manager,dc=linuxldap,dc=org" bindmethod=simple credentials=secret searchbase="dc=linuxldap,dc=org" type=refreshOnly interval=00:00:00:05 retry="5 5 300 5" timeout=1 #syncRepl rid=002 # provider=ldap://ldap2:389 # binddn="cn=Manager,dc=linuxldap,dc=org" # bindmethod=simple # credentials=secret # searchbase="dc=linuxldap,dc=org" # type=refreshOnly # interval=00:00:00:05 # retry="5 5 300 5" # timeout=1 mirrormode true sockbuf_max_incoming 5000 sockbuf_max_incoming_auth 5000 database monitor Regards, Kenneth Penza

3 2

Ldap ppolicy schema entries
by Ljunghammar, Darryl K 24 Jan '08

24 Jan '08

I would like to view the ppolicy schema attributes for a user when I do a "ldapsearch" but they don't show up. For example, I would like to see the "pwdHistory" attribute for a user. I know it is being updated because if I enter a previously used password it tells me it can't be reused. I am using openldap 2.3.39-3 on a Redhat 5.1 system. TIA, Darryl

2 1

Adding new LDIF entries
by David Moderski 24 Jan '08

24 Jan '08

I am having trouble finding the correct information about adding new entries. For example, if I am loading the initial directory, do the entries need to have changetype: add or is changetype: add only used for adding attributes to existing entries? -- Dave Moderski Programmer/Analyst Atlantic Cape Community College 609-625-1111 ext. 5298

2 1

Need a multi-client schema
by Carr, Chris 23 Jan '08

23 Jan '08

[deep breath, disclaimer: I am a knowledgeable end user, having administered a LAN of Linux and Windows PCs at home for several years, but I don't code and I knew nothing of LDAP until recently. I originally submitted this to openldap-software, but the moderator said it was more appopriate for this list. I have lurked for a week with increasing agitation at my lack of technical knowledge - apologies if this question is too stupid for most of you.] I run an IMAP server on my Linux box at home (Debian Etch), so that I can read my mail from anywhere, using any IMAP client (Outlook at work, Evolution at home, Thunderbird at my in-laws, etc.). I got frustrated with having to export and import my contacts all the time, never remembering which client had the most up-to-date set. So I looked into setting up my own LDAP server so they could live in one place, available to any client, just like the email. Sadly it doesn't seem to be that simple. Apt-get install slapd went fine - Debian was even so kind as to set up a bdb database for me with suffix "dc=mydomain", so all I had to do was create a rootdn and rootpw in slapd.conf. I painstakingly exported my contacts from Outlook as CSV, via Evolution as vCard then via http://labs.brotherli.ch/vcfconvert/ into LDIF. But trying to import the result into slapd gave lots of errors, and this is when I discovered the joys of schemata. The vCard-to-LDIF converter uses a variant Mozilla-address-book schema which slapd doesn't understand. I tried tweaking the LDIF file with this python script (http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/476224) but that fell over because some of my contacts don't have email addresses. So slapd is up and running but I have no way of importing my contact info without doing some Python hacking or re-keying the info (about 400 records). Basic question: is there an existing schema that I can include in slapd.conf which will allow my contacts to be intelligible to all the clients I use (let alone might use)? They are just basic person data: names, postal addresses, phone/fax numbers, email addresses, etc. Assuming no, can I combine a schema for each client, if I can find one? For example, the Mozilla one is here (https://bugzilla.mozilla.org/attachment.cgi?id=166746), which will work for Thunderbird, SeaMonkey etc. If I can find one for Evolution and one for Outlook, could I just include them all, or would there be incompatibilities? (Even if there aren't, a quick look at the Mozilla one leads me to suspect that I would need to duplicate numerous fields.) Does anyone successfully use LDAP with multiple clients? Is there an easy way to do it? Judging from the 'AD-style AUX classes' thread there are some issues with Outlook - in the first instance I would be happy if both Evolution and Thunderbird/SeaMonkey could see and edit the same contact data. Thanks in advance for any help, and apologies for the lengthy footer over which I have no control, CC This e-mail may contain information which is confidential, legally privileged and/or copyright protected. This e-mail is intended for the addressee only. If you receive this in error, please contact the sender and delete the material from your computer

3 7

Openldap / windows active directory sync
by अनुज Anuj Singh 23 Jan '08

23 Jan '08

Hi, I have one microsoft windows active directory server, 1. How to implement Openldap and Windows dircetory sync so that any user can get authorized from Openldap or M$ active directory. 2. User information/password sync How to sync windows Active directory with Openldap vice-versa. any tutorial/ how to? Thanks and regards Anuj

1 0

openldap 2.4.7 Segfault when deleting olcAccess parameter from cn=config
by Faraz Khan 22 Jan '08

22 Jan '08

When trying to delete a single olcAccess attribute from cn=config the openldap server crashes. The client library (php) returns error code -1 (cant contact LDAP Server) and the openldap server crashes. The delete operation is: dn: olcDatabase={2}bdb,cn=config changetype: modify delete: olcAccess olcAccess: 2 This behavior is not consistent. Sometimes the server crashes while sometimes it will report back : modifying entry "olcDatabase={2}bdb,cn=config" ldap_modify: No such attribute (16) It might continue to say Error 19 for a while (3-4 times) and on the 5th time the operation completes successfully. However, the dn at this time seems to contain NO entries. After this slapd crashes. Restarting will show that the operation was never ACTUALLY completed. The segfault trace is: ber_dump: buf=0x82c1ef0 ptr=0x82c1ef3 end=0x82c1f2c len=57 0000: 66 37 04 1c 6f 6c 63 64 61 74 61 62 61 73 65 3d f7..olcdatabase= 0010: 7b 32 7d 62 64 62 2c 63 6e 3d 63 6f 6e 66 69 67 {2}bdb,cn=config 0020: 30 17 30 15 0a 01 01 30 10 04 09 6f 6c 63 61 63 0.0....0...olcac 0030: 63 65 73 73 31 03 04 01 32 cess1...2 conn=0 op=3 do_modify: dn (olcdatabase={2}bdb,cn=config) ber_scanf fmt ({e{m[W]}}) ber: ber_dump: buf=0x82c1ef0 ptr=0x82c1f15 end=0x82c1f2c len=23 0000: 30 15 0a 01 01 30 10 04 09 6f 6c 63 61 63 63 65 0....0...olcacce 0010: 73 73 31 03 04 01 32 ss1...2 >>> dnPrettyNormal: <olcdatabase={2}bdb,cn=config> => ldap_bv2dn(olcdatabase={2}bdb,cn=config,0) <= ldap_bv2dn(olcdatabase={2}bdb,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={2}bdb,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={2}bdb,cn=config)=0 <<< dnPrettyNormal: <olcDatabase={2}bdb,cn=config>, <olcDatabase={2}bdb,cn=config> conn=0 op=3 modifications: delete: olcaccess one value, length 1 conn=0 op=3 MOD dn="olcDatabase={2}bdb,cn=config" conn=0 op=3 MOD attr=olcaccess <= acl_access_allowed: granted to database root Segmentation fault -- Faraz R Khan Chief Architect Emergen Consulting Pvt Ltd www.emergen.biz

2 1

> posixGroup & memberOf
by vip43＠mail.ru 22 Jan '08

22 Jan '08

Hi colleagues, HOW to make posixGroup a memberOf another posixGroup?? ... : nis.schema > posixGroup objectclass : ---------- objectclass ( 1.3.6.1.1.1.2.2 NAME 'posixGroup' DESC 'Abstraction of a group of accounts' SUP top STRUCTURAL MUST ( cn $ gidNumber ) MAY ( userPassword $ memberUid $ member $ description ) ) ----------- and where is "memberOf" ?? it seems it must present in MUST.., IMHO openldapAdminGuide promised to add "memberOf attr to posixGroup..,. can i do it myself ?? And what GUI-tool can rule this moment ??,- i'm using http://ldapadmin.sourceforge.net/ , but it can't.

2 3

AD-style AUX classes
by Andrew Bartlett 21 Jan '08

21 Jan '08

I'm not quite sure what I'm looking for here, sorry: In Samba4, we don't yet have full schema validation. In some ways it just has not been a priority - we validate that the attribute and objectClasses exist, but not that they match up. In using OpenLDAP, I'm hoping to avoid having to write that logic, so I stopped adding extensibleObject to all our objectClass values, and replaced it with samba4Top, contaning all the things that AD's top contains, but OpenLDAPs does not. So far so good, but AD has: dn: CN=Domain-DNS,${SCHEMADN} objectClass: top objectClass: classSchema subClassOf: domain systemAuxiliaryClass: samDomain Looking at http://www.grotan.com/ldap/microsoft.ext.schema I created entries in my schema file like: dITContentRule ( 1.2.840.113556.1.5.67 NAME 'domainDNS' AUX ( samDomain ) ) dITContentRule ( 1.2.840.113556.1.5.3 NAME 'samDomain' AUX ( samDomainBase ) ) This created two problems: It appears that you cannot create a ditContentRule for a non-structural objectClass (samDomain is AUXILIARY), and even if I do, I can't tack on the samba4Top on the end, because of: Adding DomainDN: DC=samba,DC=example,DC=com (permitted to fail) ldb load failed: LDAP error 65 LDAP_OBJECT_CLASS_VIOLATION - <class 'samba4Top' not allowed by content rule 'domainDNS'> <> Is there a different approach I should be taking? I need to extend 'top' without extending OpenLDAP's hardcoded top, and I need something that looks like dITcontentRule without the restrictions. Any hints? Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

5 16

MinGW, OpenLDAP and OpenSSL
by Jonathan Bowman 20 Jan '08

20 Jan '08

Greetings all, I recently set out to compile OpenLDAP with SSL/TLS on Windows using MinGW, so that I could compile Ruby/LDAP and python-ldap. It took me a while to find my way, and I frequently wished there were easy instructions online, all in one place. Once I successfully finished, I posted my instructions here: http://bowmansolutions.com/mingw-openldap/ I would love feedback on these instructions, affirmation or criticism. My apologies if they duplicate what is already out there. Regards, Jonathan Bowman

2 2

sql to ldap MD5 conversion
by Antoine Jacoutot 18 Jan '08

18 Jan '08

Hi. After several failed attempts, I need some help regarding the following issue. I need to import some users from a MySQL database to OpenLDAP. I cannot find a working way of converting the md5 password stored in the database (using md5() ) to the {MD5} password format for Ldap. e.g: SQL: the md5 value of 'password' is 5f4dcc3b5aa765d61d8327deb882cf99 OpenLDAP: the result of `slappasswd -h {MD5} -s password` is {MD5}X03MO1qnZdYdgyfeuILPmQ== So obviously I won't be able to use {MD5}5f4dcc3b5aa765d61d8327deb882cf99 >From what I could gather it has to do with Base64 encoding but all my attemps at scripting something failed miserably :( Any hint would be appreciated. Thanks! -- Antoine

2 2

automatic charset conversion?
by Stefan Palme 18 Jan '08

18 Jan '08

Hi, using an OpenLDAP server installation for several things. One thing is a shared addressbook which is used by different persons with different client applications. Some of them have a locale of "de_DE.utf8", some of them work with "de_DE.latin1", some of them use windows and so have a win-1250-or-whatever encoding. When creating new addressbook entries these are transfered from the client to the server in the clients charset encoding. When clients with other encodings read these entries they seem somehow broken - of course. How to solve this problem? When the server known the "client encoding" the server could automatically convert clients data into e.g. utf8 before storing it. Before sending data back to a client it could convert all the stored utf8-data into client's encoding. But I did not found a way to tell the server the client's encoding, so this seems to be no way. Are there any working solutions for this? Regards -stefan- -- ------------------------------------------------------------------- Dipl. Inf. (FH) Stefan Palme email: kleiner(a)hora-obscura.de www: http://hbci4java.kapott.org http://converter-db.de icq: 36376278 key fingerprint: 1BA7 D217 36A1 534C A5AD F18A E2D1 488A E904 F9EC -------------------------------------------------------------------

2 2

Coverity Report for Openldap library
by meow＠computer.org 17 Jan '08

17 Jan '08

Hi : Our development project is using Openldap library, currently using version 2.2.26, planning to migrate to a newer version. And, recently, I saw in scan.coverity is generating Error report for Openldap library . So, I downloaded the latest stable release 2.3.39, check the CHANGES doc to see if coverity fixes were included; but this doc didn;t mention anything regarding fixes for Coverity Error . Just want to know if latest stable release 2.3.39 contain the fixes to the Error reported in the Coverity ? And, how can I get access to the Coverity Report for Openldap library ? Thanks in advance for your time and information! Regards, Yen

2 1

Re: sles 10 synchronize 2 ldapservers
by bakkerru 17 Jan '08

17 Jan '08

Hi, The two directories must contain the same users and groups, and when i add a user on ldapserver off.company.nl it also has to be automativcally create the user on the second ldapserver mail.company.nl. i use openldap 2.3.32 on off.company.nl and 2.2.24 on mail.company.nl regards ruurd -----Oorspronkelijk bericht----- Van: openldap-technical-bounces+ruurd.bakker=ppc.nl(a)OpenLDAP.org [ <mailto:openldap-technical-bounces+ruurd.bakker=ppc.nl@OpenLDAP.org> mailto:openldap-technical-bounces+ruurd.bakker=ppc.nl@OpenLDAP.org] Namens Buchan Milne Verzonden: woensdag 16 januari 2008 7:48 Aan: openldap-technical(a)openldap.org CC: bakkerru Onderwerp: Re: sles 10 synchronize 2 ldapservers On Tuesday 15 January 2008 17:42:08 bakkerru wrote: > Question: > > How can i sychronize the users and groups of 2 ldap servers. 1 is > setup as pdc with samba and openldap (SLES10) domain "off.company.nl" > and the other is our mailserver installed with ldap and openexchange > (SLES9.3) domain mail.company.nl. how can i sync the users between > both. The mailserver is in a DMZ. You seem to have two issues here, and you're not clear which one you are trying to address. 1)Are you trying to merge the contents of two different directories? or 2)Are you trying to ensure that the contents of the directory on one server is available on another server? or 3)both? I am not aware of tools to merge the contents of two directories, but you could either do it manually, or write some scripts (which would depend on the contents of the directories). Once you have one directory containing all the information, use the replication tools which are provided to keep the directory in sync across your two servers. To be able to recommend which replication tool to use, you need to supply the versions of OpenLDAP you are using (which may generate a recommendation to upgrade at least one of them ...). Regards, Buchan

4 3

Script to check connections made
by Gustavo Mendes de Carvalho 16 Jan '08

16 Jan '08

Hi All, I would like to know if somebody has some script or knows where I can find one, that reads ldap.log file and creates a report where it's possible to check who logged in which machine, and when this connections was made. Regards --- Gustavo e-mail: gmcarvalho(a)gmail.com

5 5

Expired password notification
by Andris Eiduks 16 Jan '08

16 Jan '08

Hi! We use OpenLDAP for user's authentication. And now also implemented password policy. Authentication from Tomcat works without problem but customers find out about expired passwords only after unsuccessful binding when all limits are exceeded. ldapsearch with option "-e ppolicy" shows info about necessary password change. Is possible to get the same info by BIND operation performing from other systems side again OpenLDAP? Or we must create special functions in application for user attributes checking (pwdChangedTime, pwdGraceUseTime) and notification generation ? Thanks in advance,

4 6

how to change attribute display order
by Winanjaya - CBN 16 Jan '08

16 Jan '08

Dear All, How do I change attribute display order? ..(ie. sn, cn to cn, sn) .. pls advise thanks & regards Winanjaya *********************** Our outgoing mail has been scanned by MSS. ***********-***********

3 2

Subtree renames and memberOf handling
by Andrew Bartlett 16 Jan '08

16 Jan '08

I perhaps should have flagged this earlier, but I wanted to actually have the test to prove it. It appears that subtree renames and the memberOf plugin are not handled correctly. That is: I create cn=ldaptestuser4,cn=ldaptestcontainer,DC=samba,DC=example,DC=com I add it to a group: dn: cn=ldaptestgroup2,cn=users,DC=samba,DC=example,DC=com changetype: modify add: member member: cn=ldaptestuser4,cn=ldaptestcontainer,DC=samba,DC=example,DC=com Then I rename the container CN=ldaptestcontainer,DC=samba,DC=example,DC=com into CN=ldaptestcontainer2,DC=samba,DC=example,DC=com However, when I search: [abartlet@naomi source]$ bin/ldbsearch -H st/dc/private/sam.ldb "cn=ldaptestgroup2" # record 1 dn: CN=ldaptestgroup2,CN=Users,DC=samba,DC=example,DC=com member: cn=ldaptestuser,cn=useRs,dc=samba,dc=example,dc=com member: cn=ldaptestcomputer,cn=computers,dc=samba,dc=example,dc=com member: cn=ldaptestuser2,cn=users,dc=samba,dc=example,dc=com member: cn=ldaptestuser4,cn=ldaptestcontainer,dc=samba,dc=example,dc=com [abartlet@naomi source]$ bin/ldbsearch -H st/dc/private/sam.ldb "cn=ldaptestuser4" # record 1 dn: CN=ldaptestuser4,CN=ldaptestcontainer2,DC=samba,DC=example,DC=com cn: ldaptestuser4 memberOf: cn=ldaptestgroup2,cn=users,dc=samba,dc=example,dc=com The 'member' attribute on the group is wrong, most likely because such a subtree rename would never cause the memberOf module to fire and notice that this needs updating. Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

3 14

memberOf hidden?
by Andrew Bartlett 16 Jan '08

16 Jan '08

One of the odd things I've noticed since moving to OpenLDAP managing memberOf is that memberOf is a hidden attribute by default. Is that because it is treated as operational (due to being managed by the module)? I can un-hide it for Samba (I have code that adds a list of attributes to any query for *), but I just wanted to check there wasn't a more elegant way to do it. Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

4 19

LDAP and oracle
by florian.engelmann＠bt.com 16 Jan '08

16 Jan '08

Hi, We just migrated our unix/linux accounts to LDAP. We decided to migrate every user account that can login (except root) to LDAP. Now we have heavy load on our LDAP systems and I think this is because we also migrated the oracle users that are running our oracle databases. This is because the oracle admins log on the systems using the user the database is running with. I do not know that much about oracle but is it mandatory to administrate an oracle database with the same user? Does it make sense to migrate systemusers to ldap? Florian Engelmann

2 3

sles 10 synchronize 2 ldapservers
by bakkerru 16 Jan '08

16 Jan '08

Question: How can i sychronize the users and groups of 2 ldap servers. 1 is setup as pdc with samba and openldap (SLES10) domain "off.company.nl" and the other is our mailserver installed with ldap and openexchange (SLES9.3) domain mail.company.nl. how can i sync the users between both. The mailserver is in a DMZ. thanks in advantage Ruurd

4 3

objectIdentifier Macros?
by Gavin Henry 15 Jan '08

15 Jan '08

Evening all, Are OID Macros specific to slapd? Thanks. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

2 4

update with perl
by alois blasbichler 15 Jan '08

15 Jan '08

Hello list We use openldap 2.3.39. I want to add with a perl-script to all my users this attributes : objectClass: orcluser orclpassword: xxxxxxxxx I dont now how do that with a script. Actually my users haves this objectClasses : objectClass: top objectClass: hordePerson objectClass: shadowAccount objectClass: posixAccount objectClass: person objectClass: inetOrgPerson objectClass: SuSEeMailObject objectClass: sambaSamAccount I defined an : objectclass ( 1.1.2.881.881.555.666 NAME 'inetorcluser' DESC 'inetorcluser' SUP ( inetOrgPerson $ orcluser ) STRUCTURAL ) And so when i with an ldap-browser export an user, then after deleting this user i add in the ldif-datei the followings attributes: objectClass: inetorcluser objectClass: orcluser orclpassword: xxxxxxxxx then i can import this user fine. That for one user is ok but for a lot of users how can i do that - i tried with perl - but without success. Thanks in advanced for any help. luis

3 3

Silly details like CN= v cn=
by Andrew Bartlett 14 Jan '08

14 Jan '08

I've been working on making Samba4 pass it's testsuite with OpenLDAP as a backend. One of my tests does what no LDAP client should do - it applies a case sensitive comparison of the returned DN, compared with what we expect and get from AD. For example, we search for cn=ldaptestmachine and then ensure we get: CN=ldaptestmachine,CN=Users,DC=samba,DC=example,DC=com OpenLDAP returns cn=ldaptestmachine,cn=users,dc=samba,dc=example,dc=com which I'm sure is perfectly valid, but if I can write a bodgy script with case sensitive comparisons, so can an admin or sloppy app. Working in the windows space makes me like to eliminate differences where I can. Can the case of the attribute names (CN and DC) in that DN be made to be UPPER case easily? (Alternately I'll write a filter module on the Samba4 side to do that). Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

4 11

Chain authentication bind configuration
by Dave Stoll 13 Jan '08

13 Jan '08

Hello - I seem to have run into a bit of a roadblock with my configuration. I am trying to build an OpenLDAP server which uses ref: entries to chain to two other LDAP servers for user authorization. I have been able to get everything working fine so long as I allow anonymous binding on the servers referenced from OpenLDAP. Unfortunately, the security folks are requesting the OpenLDAP server to force bind credentials for the particular ldap uri. >From man slapd-ldap(5) I see the following: acl-bind ... This identity is by no means implicitly used by the proxy when the client connects anonymously. The idassert-bind feature, instead, in some cases can be crafted to implement that behavior, which is intrinsically unsafe and should be used with extreme care. This directive obsoletes acl-authcDN, and acl- passwd. ... Unfortunately, I¹m having a bit of difficulty finding any documentation supporting the ability to implicitly use a particular bindDN and simple authentication password, regardless of whether the query is anonymous or authenticated. Any help would be welcome. Cheers, Dave -- Dave Stoll echo mac | sed 's/^/dave.stoll(a)/;s/$/.com/'

2 6

NOOP and case change renames
by Andrew Bartlett 11 Jan '08

11 Jan '08

I'm up against my next challenge in the great challenge of Samba4 and OpenLDAP. As metioned on openldap-devel, I've hit up against renaming DNs onto themselves. For example, I previously mentioned cn=ldaptestuser2,cn=users,DC=samba,DC=example,DC=com into cn=ldaptestuser3,cn=users,DC=samba,DC=example,DC=com This should become: dn: cn=ldaptestuser2,cn=users,DC=samba,DC=example,DC=com changetype: modrdn newrdn: cn=ldaptestuser2 deleteoldrdn: 1 > RFC 4511 states that a modify DN operation must fail with the > entryAlreadyExists result code if there was already an entry with that > name. However, a broad interpretation would recognize that such a > modify DN operation is going to be a no-op and simply ignore it. The > specific case doesn't seem to be explicitly dealt with in RFC 4511. I've written a module to cause this to never reach the DB, but my next test (which AD also permits) is: cn=ldaptestuser3,cn=users,DC=samba,DC=example,DC=com into cn=ldaptestUSER3,cn=users,DC=samba,DC=example,DC=com So it seems I need some backend help. Is there another way I should be handling case changes in a DN, or could/should the DB be modified to allow these operations? (These tests arose because a user tried to do exactly this from the windows management tools, and we also failed to allow it in ldb). Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

2 5

Newbie - how to change display name settings
by Winanjaya - CBN 10 Jan '08

10 Jan '08

Hello All, I am very new with this, I have configured openldap on my FC1 .. Currently, the Display name settings is Last Name, First Name .. how to change it to FirstName, Last Name? Please help Thanks & Regards Winanjaya *********************** Our outgoing mail has been scanned by MSS. ***********-***********

4 7

simple-auth to SASL mapping?
by Stefan Palme 09 Jan '08

09 Jan '08

Hi all, I have setup an OpenLDAP server for users authenticating using SASL. The authz-regexp "converts" the SASL identity into a DN which is used only for authorization purposes - there are no real LDAP entries with these DNs. This setup works fine. Now I have some LDAP client applications that only support simple authentication, but no SASL authentication. So I am looking for a way to "map" simple authentication to SASL authentication, e.g. when a user uses simple auth with DN "cn=user1,ou=users,dc=domain,dc=com" this mechanism should authenticate this user via SASL using username "user1" and the provided password. I absolutely DO NOT WANT to create real LDAP entries for these users, because the user database is an external one accessed via SASL->PAM->COMPLICATED_PAM_MODULES, and I dont want to manage user accounts in two places :-) Is this possible? I already thought about using an "ldap"-backend to proxy simple-auth-connections, but I did not found a way to just "rewrite" the authentication information and make the proxy server using SASL with a username extracted from the simple auth DN... Thanks and best regards -stefan-

2 2

Regarding ldap client library with php ldap exop patch
by Faraz Khan 09 Jan '08

09 Jan '08

This is regarding the php ldap exop patch published by Pierangelo Masarati at : http://www.sys-net.it/~ando/Download/#PHP%3E I BADLY require paged results for my ldap based application. The patch applies fine to PHP 5_2 HEAD. However, two things need to be changed. 1. the zstr struct does not exist, which needs to be defined. This is not a problem. Solved with some help from PHP developers on what zstr is. 2. In the function php_ldap_do_search(INTERNAL_FUNCTION_PARAMETERS, int scope) in ldap.c, timelimit is set to -1 as follows: int ldap_attrsonly = 0; int ldap_sizelimit = -1; int ldap_timelimit = -1; The ldap_search operation keeps on returning a LDAP ERROR : Timeout in this case. Modifying timelimit to : int ldap_timelimit = 300; for example fixes the issue and pagination works. I'm guessing the following is what causes problems: #ifdef HAVE_LDAP_SEARCH_EXT_S /* Run the actual search */ { int rc; struct timeval tv; tv.tv_sec = ldap_timelimit; tv.tv_usec = 0; rc = ldap_search_ext(ld->link, ldap_base_dn, scope, ldap_filter, ldap_attrs, ldap_attrsonly, NULL, NULL, &tv, ldap_sizelimit, &rcs[i] ); /* TODO: check rc == LDAP_SUCCESS */ } the tv.tv_usec=0 when tv.tv_sec = -1 Just a hunch. How does ldap_search_ext handle timelimit? Thank you. I currently have it set to 300, which is bad, and it seems to be working fine. Please remember the problem (with the patch applied) happens not only to paged requests but any ldap_search request (keeps timing out instantaneously) -- Faraz R Khan Chief Architect Emergen Consulting Pvt Ltd www.emergen.biz

1 0

Password expiration question (ppolicy and smbk5wpd interaction)
by Pat Riehecky 08 Jan '08

08 Jan '08

Like many before me I would love to get the smbk5pwd module up and running, but I have a question. In OpenLDAP 2.4.7: If I set a password expiration time up (with ppolicy), and the user's password expires, does it lock the Heimdal, Samba, and ldap passwords? On the flip side, if I set a password expiration time up (with smbk5pwd), and the user's password expires, does it lock the Heimdal, Samba, and ldap passwords? Or perhaps more to the point, what can I do to keep all three of these passwords either all valid or all expired at the same time? The documentation is a bit vague on this one point, and the archives left me still in confusion..... Pat

3 2

Decoding error when splitting a DN with ldap_str2dn()
by Michael Ströder 07 Jan '08

07 Jan '08

HI! I have a problem splitting a DN with ldap_str2dn(). Actually I'm using it from python-ldap but judging from the debug output there does not seem to be an issue with passing the DN to the OpenLDAP API (see Python console output below). Any clue what's wrong with this DN? OID.0.2.262.1.10.7.20=1 + CN=DIR DATEV D12 1:PN, O=DATEV eG, C=DE BTW: Removing the spaces around , and + does not help either. Ciao, Michael. -------------------------------- snip -------------------------------- Python console: >>> ldap.set_option(ldap.OPT_DEBUG_LEVEL,65535) >>> dn 'OID.0.2.262.1.10.7.20=1 + CN=DIR DATEV D12 1:PN, O=DATEV eG, C=DE' >>> ldap.dn.str2dn(dn) => ldap_bv2dn(OID.0.2.262.1.10.7.20=1 + CN=DIR DATEV D12 1:PN, O=DATEV eG, C=DE,0) ldap_err2string <= ldap_bv2dn(OID.0.2.262.1.10.7.20=1 + CN=DIR DATEV D12 1:PN, O=DATEV eG, C=DE)=-4 Decoding error Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/lib/python2.5/site-packages/ldap/dn.py", line 50, in str2dn return ldap.functions._ldap_function_call(_ldap.str2dn,dn,flags) File "/usr/lib/python2.5/site-packages/ldap/functions.py", line 59, in _ldap_function_call result = func(*args,**kwargs) ldap.DECODING_ERROR >>>

3 4

Relative Distinguished Name searches
by Andrew Bartlett 07 Jan '08

07 Jan '08

In Samba4, I currently have a module that creates and maintains the 'name' attribute for our AD look-alike. Unlike in other systems, where this is related to 'cn', in AD this is always the relative distinguished name. I wondered if it might be possible (by some extended matching of some kind) to transform a search of 'name=foo' into something that does not require the manual maintenance of a samba4RDN attribute? (such a matching might then avoid problems if, in future, we allow clients direct access to the backend). Any thoughts? Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc.

2 1

CN must be indexed?
by Andrew Bartlett 06 Jan '08

06 Jan '08

Working on the OpenLDAP backend for Samba4, I'm wondering if this is expected: Is 'cn' a special attribute in the OpenLDAP code? It seems that the builtin schema definition (or something else) requires that the 'cn' attribute be indexed with index cn eq Otherwise, searches for cn=foo fail, where cn=foo* succeeds... I'm using current CVS, and trying to have Samba4 automatically generate configuration files for OpenLDAP, possibly based on the (AD) schema-data we will load into the directory. As such, knowing any (particularly other, similar) OpenLDAP-imposed constraints will be very useful, so that I can ensure these are met by the provision-backend script in Samba4. Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. http://redhat.com

2 5

Packaging libldap and libldap_r
by Russ Allbery 06 Jan '08

06 Jan '08

I'm one of the people who works on packaging OpenLDAP for Debian, and I'm trying to figure out what the right way to deal with libldap and libldap_r would be. Here's the problem that Debian has (which I expect is shared by other distributors): As I understand it, libldap_r is the thread-safe library and libldap is not thread-safe, so threaded applications have to link with libldap_r. However, libldap and libldap_r both contain the same symbols and don't use symbol versioning. So if both are loaded into the same process space at the same time, it's undefined which library is called, which can cause all sorts of problems. Therefore, for modules like nss-ldap that are loaded into the process space of almost every system process, there is no good option for which library to link against in the presence of both libraries: Linking with libldap because nss-ldap isn't threaded means that threaded applications that link with libldap_r may resolve symbols to the wrong library. Threaded applications may also get undefined results if they call NSS functions. But linking nss-ldap with with libldap_r to be safe for threaded applications will cause problems for any application linked with libldap. Note that nss-ldap is just an example, useful because it's fairly obvious. The same problem applies to any situation where multiple libraries may be mingled in a process space: PAM-using servers with pam-ldap, Apache with mod_ldap and mod_python or mod_perl loading LDAP modules, etc. What's the recommended way of dealing with this problem? I'd like whatever solution we use to be something that you're comfortable with. It's worth noting, btw, that glibc provides stubs for pthread functions, allowing libraries that need to be thread-safe in threaded programs but not in unthreaded programs to gain back the speed lost to locking when running without threads. In order to use this, the library should *not* be linked directly with the pthread library. glibc will provide stubs that do nothing if libpthread isn't loaded, and if it is, they will be transparently replaced by the correct threading code. This would eliminate the need to have two separate libraries. However, glibc only provides these stubs for a limited number of functions, and libldap_r currently references pthread functions outside of that set. I believe the other symbols may only be used in the code that supports slapd, although I could be wrong. Attached is the list of functions for which stubs are provided. pthread_attr_destroy pthread_attr_getdetachstate pthread_attr_getinheritsched pthread_attr_getschedparam pthread_attr_getschedpolicy pthread_attr_getscope pthread_attr_init pthread_attr_setdetachstate pthread_attr_setinheritsched pthread_attr_setschedparam pthread_attr_setschedpolicy pthread_attr_setscope pthread_cond_broadcast pthread_cond_destroy pthread_cond_init pthread_cond_signal pthread_cond_timedwait pthread_cond_wait pthread_condattr_destroy pthread_condattr_init pthread_equal pthread_exit pthread_getschedparam pthread_mutex_destroy pthread_mutex_init pthread_mutex_lock pthread_mutex_unlock pthread_self pthread_setcancelstate pthread_setcanceltype pthread_setschedparam -- Russ Allbery (rra(a)stanford.edu) <http://www.eyrie.org/~eagle/>

1 0

openldap adressbook
by digitom 04 Jan '08

04 Jan '08

Hello, I've want to set up an email server with dovecot, postfix openldap etc. Now my problem is to set up an openldap adressbook for Evolution. I've could add a new contact to the database via Evolution, and can see the contact via phpldapadmin and with Evolution. But if I restart Evolution, all contacts are lost (in Evolution, in phpldapadmin I still could see the conatcts.) Where is the problem? I've activated all possible log statements, but there's no needful information. (for me:) I've using debian etch with slapd 2.3.30-5 and Evolution 2.12.1. Now my slapd.conf: include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/evolutionperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel conns filter config trace args BER ACL stats stats2 shell parse index modulepath /usr/lib/ldap moduleload back_bdb sizelimit 500 tool-threads 1 backend bdb checkpoint 512 30 database bdb suffix "dc=testdomain" rootdn "cn=admin,dc=testdomain" rootpw {SSHA} ... and my ldif: dn:dc=testdomain objectClass: dcObject objectClass: organization o: my-example dc:testdomain dn:cn=admin,dc=testdomain objectClass: organizationalRole cn:admin dn:ou=contacts,dc=testdomain ou: contacts objectClass: organizationalUnit Do you need any further information to help me??? Thanks in advance. Thomas

3 2

[Unofficial] OpenLDAP Weekly News Issue 7
by Gavin Henry 04 Jan '08

04 Jan '08

Dear All, The seventh issue is out: http://blog.suretecsystems.com/categories/1-OpenLDAP Summary: - OpenLDAP 2.4.7 Released - OpenLDAP 2.3.40 Released - New Mailing List - Update on Build Farm - Contributions - OpenLDAP Documentation updates - OpenLDAP Development - Community Binaries - Blog LDAP Schema Update - "If there was an OpenLDAP Cookbook, what recipes would you like to see?" - Selected user issues and solutions discussed - LDAP Roundup Thanks, Gavin. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/

1 0

Cannot replicate userPassword?
by Thomas Kirchtag 02 Jan '08

02 Jan '08

My setup is rather basic. ldaps://ldap.ipodion.at is master/sync provider. "consumer" is slave/consumer. Everything seems to be working fine, all attributes are replicated with the notable exception of the userPassword attribute. ldapsearch on the consumer shows the missing attributes, so it can't be a permissions problem: consumer # ldapsearch -x -LL -D "cn=admin,dc=ipodion,dc=at" -W -H ldaps://ldap.ipodion.at -b "dc=int,dc=ipodion,dc=at" "(objectClass=person)" uidNumber userpassword Enter LDAP Password: version: 1 dn: cn=NextFreeUnixId,dc=int,dc=ipodion,dc=at uidNumber: 10007 dn: uid=tkircht,ou=people,dc=int,dc=ipodion,dc=at uidNumber: 500 userPassword:: e1NNRDV9dXZ1UkxMY1VDaThMSktablRSazJWMElCU2l dn: uid=Administrator,ou=People,dc=int,dc=ipodion,dc=at uidNumber: 0 userPassword:: e1NNRDV9c2swZEtCMzUyb2JQTkRucTcxcDczc0VScXpB [...] I added the acl for uidNumber just to make sure I didn't mistype any credential information, but the uidNumber attribute is replicated the user Password isn't.. I cannot find anything on this in the archives or the documentation - what am I doing wrong here?! Any help would be appreciated thanks, Thomas Config files: --------------------------------------------------------- provider: --------------------------------------------------------- ldap:~# grep -v '^#' /etc/ldap/slapd.conf | grep -v '^$' allow bind_v2 include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/extension.schema schemacheck on pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args TLSCertificateFile /etc/ssl/certs/ldap.ipodion.cert.pem TLSCertificateKeyFile /etc/ssl/private/ldap.ipodion.key.pem TLSCACertificateFile /usr/share/ca-certificates/cacert.org/root.crt loglevel -1 modulepath /usr/lib/ldap moduleload back_bdb moduleload back_meta moduleload syncprov backend bdb database bdb suffix "dc=ipodion,dc=at" directory "/var/lib/ldap" overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 index objectClass eq index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub lastmod on rootdn "cn=admin,dc=ipodion,dc=at" rootpw <secret> access to attrs=userPassword by dn="cn=admin,dc=ipodion,dc=at" write by anonymous auth by self write by * none access to attrs=uidNumber by dn="cn=admin,dc=ipodion,dc=at" write by anonymous auth by self write by * none access to dn.subtree="ou=addressbook,dc=ipodion,dc=at" by self write by dn="cn=admin,ou=addressbook,dc=ipodion,dc=at" write by * read access to dn.base="" by * read access to * by dn="cn=admin,dc=ipodion,dc=at" write by * read --------------------------------------------------------- consumer: --------------------------------------------------------- consumer:~# grep -v '^#' /etc/ldap/slapd.conf | grep -v '^$' allow bind_v2 include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema schemacheck on pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args TLSCACertificateFile /etc/ssl/CA/cacert.pem loglevel 256 modulepath /usr/lib/ldap moduleload back_bdb backend bdb database bdb suffix "dc=int,dc=ipodion,dc=at" directory "/var/lib/ldap" index objectClass eq index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub lastmod on rootdn "cn=admin,dc=int,dc=ipodion,dc=at" rootpw {SSHA}<secret2> syncrepl rid=667 provider=ldaps://ldap.ipodion.at type=refreshOnly interval=01:00:00:00 searchbase="dc=int,dc=ipodion,dc=at" scope=sub schemachecking=on bindmethod=simple binddn="cn=admin,dc=ipodion,dc=at" credentials=<secret> access to attrs=userPassword by dn="cn=admin,dc=int,dc=ipodion,dc=at" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=int,dc=ipodion,dc=at" write by * read -- ========================================================= iPodion GmbH Rotensterngasse 20/3 A-1020 Wien, Austria Mobil: +43-660-216 32 98 Tel.:+43-1-216 32 98-0 mailto:office@iPodion.at Fax: +43-1-216 32 98-28 http://www.iPodion.at ========================================================= Achtung: Bitte beachten Sie meine neue Telefonnummer: 0660/2163298

4 7

ldap_set_option/ldap_bind_s segfaults
by Johan Ström 31 Dec '07

31 Dec '07

Hi list Im trying to run pure-ftpd 1.0.21 on a FreeBSD 7.0-amd64 (still beta yes) host, with LDAP (openldap-2.3.39) as auth backend. However the authing doesnt seem to work at all, as soon as password is sent the client gets disconnected. I've posted this similar message (altough more debugging info now) to their list without a single response. Tracing the problem got me to the following code (pureftpd's log_ldap.c, with a lot of logfile statements inserted by me): 110 static LDAP *pw_ldap_connect(void) 111 { 112 LDAP *ld; 113 # ifdef LDAP_OPT_PROTOCOL_VERSION 114 int version = ldap_version; 115 # endif 116 117 if (ldap_host == NULL || port < 0) { 118 logfile(LOG_DEBUG, "bad host"); 119 return NULL; 120 } 121 logfile(LOG_DEBUG, "initing to host %s port %d", ldap_host, port); 122 if ((ld = ldap_init(ldap_host, port)) == NULL) { 123 logfile(LOG_DEBUG, "init failed"); 124 return NULL; 125 } 126 logfile(LOG_DEBUG, "init ok ld is %p", ld); 127 # ifdef LDAP_OPT_PROTOCOL_VERSION 128 logfile(LOG_DEBUG, "setting version %d", version); 129 if (ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version) != 130 LDAP_SUCCESS) { 131 logfile(LOG_DEBUG, "failed versionset"); 132 return NULL; 133 } 134 logfile(LOG_DEBUG, "versionset ok"); 135 # endif 136 logfile(LOG_DEBUG, "binding"); 137 if (ldap_bind_s(ld, root, pwd, LDAP_AUTH_SIMPLE) != LDAP_SUCCESS) { 138 logfile(LOG_DEBUG, "bind failed"); 139 return NULL; 140 } 141 logfile(LOG_DEBUG, "bound ok"); 142 143 return ld; 144 } When running, I get this debug output Dec 29 09:31:10 back-1 pure-ftpd: (?(a)172.28.1.11) [DEBUG] ldap entered Dec 29 09:31:10 back-1 pure-ftpd: (?(a)172.28.1.11) [DEBUG] connecting Dec 29 09:31:10 back-1 pure-ftpd: (?(a)172.28.1.11) [DEBUG] initing to host localhost port 389 Dec 29 09:31:10 back-1 pure-ftpd: (?(a)172.28.1.11) [DEBUG] init ok ld is 0x1297180 Dec 29 09:31:10 back-1 pure-ftpd: (?(a)172.28.1.11) [DEBUG] setting version 3 Dec 29 09:31:10 back-1 kernel: pid 97603 (pure-ftpd), uid 0: exited on signal 11 After that, nothing.. And the forked process dies. As its a forked one, I havent been able to run gdb on it, so I've done the above log entrys instead.. But it seems pretty clear that it crashes when doign ldap_set_option. If i skip the set option and do bind directly, that crashes too. slapd doesnt even see the connection so I guess its something in the client part pure-ftpd: libssl.so.5 => /usr/lib/libssl.so.5 (0x800650000) libcrypto.so.5 => /lib/libcrypto.so.5 (0x80079a000) libldap-2.3.so.2 => /usr/local/lib/libldap-2.3.so.2 (0x800a2a000) liblber-2.3.so.2 => /usr/local/lib/liblber-2.3.so.2 (0x800b64000) libcrypt.so.4 => /lib/libcrypt.so.4 (0x800c72000) libpam.so.4 => /usr/lib/libpam.so.4 (0x800d8b000) libc.so.7 => /lib/libc.so.7 (0x800e93000) libsasl2.so.2 => /usr/local/lib/libsasl2.so.2 (0x8010b0000) Only have one version of the client lib installed so shouldnt be any problems there.. openldap-sasl-client-2.3.39 Open source LDAP client implementation with SASL2 support openldap-server-2.3.39 Open source LDAP server implementation I do have the same setup but with openldap-2.3.38 running fine on a FreeBSD 6.2-i386 box. Haven't seen any problems with the regular ldap* tools on this box, but havent tested any other software yet. Soo.. Anyone got any ideas? Hope this is the correct list, if not, sorry. Thanks! -- Johan Ström Stromnet johan(a)stromnet.se http://www.stromnet.se/

2 5

OpenLDAP and optional kerberos ?
by Nicolas GRENECHE 29 Dec '07

29 Dec '07

Hi all, I need tu replace an old NIS with a topnotch OpenLDAP server. I would like to add SSO support on my brand new architecture. 2 scenarii may occur : 1) Using pam_kerberos to authentaicate against KDC and retreiving information from LDAP server with SASL. The backward is that anyone (or anything) that need to authenticate MUST be kerberos aware. 2) Having LDAP and Kerberos passwords synced. Asset : You can authenticate through LDAP or kerberos (pam_ldap required an pam_kerberos optional) ie you must authenticate against LDAP and if Kerberos autentication success you get a TGT ! Backward : Two password databases to protect / lot of work on client side / passwords must be synced (Do you now materials to do it ?). I add that security is not a major concern for us and we got many OS on client side that's why the 1st solution may not fit our needs. Has someone ever experienced the second solution ? Have you some hints and feedbacks ? Thx, Nico

2 1

slapcat Segmentation fault
by John Sherling 29 Dec '07

29 Dec '07

Running OpenLDAP 2.2.19 on Darwin kernel v. 8.11.1, and when I issue: /usr/sbin/slapcat -d 5 -v -l /Users/localadmin/Desktop/bkup.ldif I get the following output: <snip>... # id=00000070 entry_decode: "cn=raidgroup,cn=groups,dc=fileserver,dc=mydomain,dc=private" <= entry_decode(cn=raidgroup,cn=groups,dc=fileserver,dc=mydomain,dc=private) # id=00000071 slapcat shutdown: initiated Segmentation fault ...</snip> Anyone know how I can track down what's causing this segmentation fault?

2 1

archive test
by Kurt Zeilenga 28 Dec '07

28 Dec '07

Test the archives....

1 0

test message
by Kurt Zeilenga 28 Dec '07

28 Dec '07

test

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical