- openldap-technical - openldap.org

difference in multi-master replication since 2.4.57
by Emmanuel Seyman 04 Mar '21

04 Mar '21

Hello, all. I have two OpenLDAP servers in production that were running 2.4.44 . Both of these servers host 5 directories, each with their own backends. This is a bog-standard 2-node RHEL7 multi-master configuration that has worked for years. The binaries are the LTB-Project rpms. I updated my OpenLDAP servers to 2.4.57 last week. A few minutes after the upgrade, I started to see syncrepl alerts in Nagios and I'm having a hard time convincing myself that the upgrade isn't responsible for the errors. The problem is that I don't see any messages in the log that stand out as being errors (granted, I'm not sure what I'm looking for). In fact, the alert flaps every once in a while as the two nodes come back in sync and drift away from each other again. Here's what the output of the syncrepl nagios plugin looks like: 2021-03-03 09:54:01: CRITICAL - directories are not in sync - 199 seconds late (W:10 - C:5) 2021-03-03 09:56:01: CRITICAL - directories are not in sync - 197 seconds late (W:10 - C:5) 2021-03-03 09:58:01: CRITICAL - directories are not in sync - 42 seconds late (W:10 - C:5) 2021-03-03 10:00:01: CRITICAL - directories are not in sync - 4200 seconds late (W:10 - C:5) 2021-03-03 10:02:01: CRITICAL - directories are not in sync - 81 seconds late (W:10 - C:5) 2021-03-03 10:04:01: CRITICAL - directories are not in sync - 201 seconds late (W:10 - C:5) 2021-03-03 10:06:01: CRITICAL - directories are not in sync - 196 seconds late (W:10 - C:5) 2021-03-03 10:08:01: CRITICAL - directories are not in sync - 42 seconds late (W:10 - C:5) 2021-03-03 10:10:01: CRITICAL - directories are not in sync - 200 seconds late (W:10 - C:5) 2021-03-03 10:12:01: CRITICAL - directories are not in sync - 81 seconds late (W:10 - C:5) I find these values surprising considering I've never seen a syncrepl error in the 2 years before the upgrade. Is there a known issue with replication in 2.4.57 that would explain these sync differences? Regards, Emmanuel

4 5

Issue on backup on Open LDAP 2.4.38
by pascal.foulon＠orange.com 03 Mar '21

03 Mar '21

Hi all Since several weeks , we met an issue on our test and UA Open LDAP main master servers version 2.4.38 hosted on Linux Red Hat 6.4 : slapd: [INFO] Using /etc/default/slapd for configuration slapd: [INFO] Launching OpenLDAP database backup... slapd: [OK] data saved in /var/opt/data/flat/openldap/backups/data-20210303154336.ldif 603fa0ac bdb(cn=changelog): Logging region out of memory; you may need to increase its size 603fa0ac hdb_db_open: database "cn=changelog": db_open(/var/opt/data/db/openldap/changelog/id2entry.bdb) failed: Cannot allocate memory (12). 603fa0ac backend_startup_one (type=hdb, suffix="cn=changelog"): bi_db_open failed! (12) slap_startup failed slapd: [ALERT] OpenLDAP database backup failed Once a week, this servers is completely updated using a backup sent from our production server On the backup master server, backup process runs well. Any idea to fix this issue ? Regards [logo Orange]<http://www.orange.com/> Pascal Foulon Concepteur Développeur Responsable Technique / MOE portail Intranet France Mobile Expert technique VMPAL-E / Quartz / Web Admin / IFM / Annuaire Groupe Orange/TGI/OLS/SOFT/IDF-NANCY/DPI mobile : +33 6 82 57 28 73 <https://monsi.sso.francetelecom.fr/index.asp?target=http%3A%2F%2Fclicvoice.…> pascal.foulon(a)orange.com<mailto:pascal.foulon@orange.com> EDS Océane 58H « Annuaire Groupe » : BJC031 EDS Océane IFM « Intranet France Mobile » : BJC038 _________________________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

2 1

openldap meta to active directory bind err=49 most explicit return information ?
by Nicolas Renault 01 Mar '21

01 Mar '21

Hi, I have a meta that proxify bind requests to 3 AD. A CAS server use the meta backend to authenticate users. if I connect into the cas ui with a user and good password , all is fine. if I connect into the cas ui with the same user and a bad password , it's fail , all is fine if I connect into the cas ui with a another user (password expired on the AD) using the good expired password, it's fail , all is fine But I want to have a information windows that says : "bad password " or "password expired" , I cannot because return code is always ' RESULT tag=97 err=49 text= ' Did someone knows a way to get the information ? ( same question with "locked account" and all the existing case ) Regards Nicolas

1 0

OpenLDAP 2.5.2 Beta binary builds for testing
by Quanah Gibson-Mount 01 Mar '21

01 Mar '21

Symas is pleased to provide binary builds of the OpenLDAP 2.5.2 beta for testing purposes only on the following select platforms. Builds install into /opt/openldap25/ with state files stored in /var/opt/openldap25/ so as to be entirely self contained. No init scripts are provided and it is expected that end testers are familiar with OpenLDAP configuration. Please file any software (not packaging) related issues found at https://bugs.openldap.org/ Platforms: Ubuntu 20.04 LTS RHEL8 and binary compatible distributions (note: requires EPEL) Fedora 34 -------------------------------------------------- Ubuntu 20.04 LTS installation instructions: sudo add-apt-repository ppa:symas/openldap25 sudo apt-get update sudo apt install openldap-clients openldap-server -------------------------------------------------- -------------------------------------------------- RHEL8 installation instructions: dnf install 'dnf-command(copr)' dnf install epel-release dnf copr enable symas/openldap25 yum install openldap25-libs openldap25-clients openldap25-server -------------------------------------------------- -------------------------------------------------- Fedora 34 installation instructions: dnf install 'dnf-command(copr)' dnf copr enable symas/openldap25 yum install openldap25-libs openldap25-clients openldap25-server -------------------------------------------------- Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 5

OpenLDAP TLS encrypted connection
by SHarbich＠t-online.de 25 Feb '21

25 Feb '21

Hi, i wanted to activate the TLS / SSL encryption for my OpenLDAP server. After I created the certificates and wanted to paste the information into the backend, I got the following error message: ... root@dsme01:~# ldapadd -x -D cn=admin,cn=config -W -f /etc/ldap/tls.ldif Enter LDAP Password: modifying entry "cn=config" modifying entry "cn=config" ldap_modify: Other (e.g., implementation specific) error (80) ... The first entry was accepted. But not the second and third. Here is my ldif file: ... root@dsme01:~# cat /etc/ldap/tls.ldif ########################################################### # CONFIGURATION for Support of TLS ########################################################### # Add TLS supported access to user passwords for LDAP clients # to the LDAP config. dn: cn=config changetype: modify add: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/certs/ManagementCA.cacert.pem dn: cn=config changetype: modify add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ssl/private/ldap.intern.example.com.key.pem dn: cn=config changetype: modify add: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/certs/ldap.intern.example.com.crt.pem ... I have saved the files as follows and given them rights. ... root@dsme01:~# ls -la /etc/ssl/private | grep ldap. -rw------- 1 openldap openldap 1675 Feb 25 08:12 ldap.intern.example.com.key.pam ... root@dsme01:~# ls -la /etc/ssl/certs | grep ldap. -rw------- 1 openldap openldap 1424 Feb 25 08:13 ldap.intern.example.com.crt.pem -rw------- 1 openldap openldap 1330 Feb 25 09:00 ManagementCA.cacert.pem ... Why am I not getting the key and cert file added? How do I get the olcTLSCACertificateFile deleted again? Thank you for your help. Greetings from Stefan Harbich

1 0

LDAP-proxy with meta-backend
by Stefan Kania 23 Feb '21

23 Feb '21

Hi, I would like to set up a OpenLDAP proxy with meta-backend. I have a test environment with two windows 2019 ADs and one OpenLDAP-server configured as proxy. At the beginning all the authentication are med with admin-accounts, it's the first step just testing. Here is my slapd.conf: ----------------------- Include /etc/ldap/schema/core.schema Include /etc/ldap/schema/corba.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/duaconf.schema include /etc/ldap/schema/dyngroup.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/java.schema include /etc/ldap/schema/misc.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/openldap.schema include /etc/ldap/schema/collective.schema include /etc/ldap/schema/pmi.schema include /etc/ldap/schema/ppolicy.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args # Load dynamic backend modules: modulepath /usr/lib/ldap moduleload rwm.la moduleload back_meta.la moduleload back_ldap.la loglevel 4095 ####################################################################### # MDB database definitions ####################################################################### database meta suffix "dc=example,dc=de" rootdn "cn=admin,dc=example,dc=de" rootpw secret uri "ldap://192.168.56.201/ou=firma-01,dc=example,dc=de" readonly yes lastmod off suffixmassage "ou=firma-01,dc=example,dc=de" "ou=firma-01,dc=dom01,dc=example,dc=net" map attribute uid sAMAccountName idassert-bind bindmethod=simple binddn="cn=administrator,cn=Users,dc=dom01,dc=example,dc=net" credentials="Passw0rd" idassert-authzFrom "*" uri "ldap://192.168.56.202/ou=firma-02,dc=example,dc=de" readonly yes lastmod off suffixmassage "ou=firma-02,dc=example,dc=de" "ou=firma-02,dc=dom02,dc=example,dc=com" map attribute uid sAMAccountName idassert-bind bindmethod=simple binddn="CN=Administrator,CN=Users,DC=dom02,dc=example,DC=com" credentials="Passw0rd" idassert-authzFrom "*" ----------------------- on my proxy I can do a "ldapsearch -x " and I can see all the wanted entries from both ADs. This is my ldap.conf on the proxy: ----------------------- BASE dc=example,dc=de URI ldap://192.168.56.210 ----------------------- 192.168.56.210 is my proxy. But now I would like to connect a client to the proxy to get the entries. The ldap.conf file is the same as on the proxy. But what ever I try I got now result. ---------------------- root@proxy-client:~# ldapsearch -x -D cn=admin,dc=example,dc=de -W -LLL No such object (32) root@proxy-client:~# ldapsearch -x -LLL No such object (32) ---------------------- What am I missing? Thank's for any help Stefan

2 2

A bit of help for a master migration.
by Frédéric Goudal 10 Feb '21

10 Feb '21

Hello, I’m in the way to replace our main ldap server with the moe nest recent version. As the OS of the current one is quite old we will host it on a new computer. For now the architecture is the following : master-ldap with two local replica via syncprov and another replica with a proxy sync (suffix on the master with a ldap backend) so we jump the internal firewall. The master-ldap is the only one in read/write so all the modifications are done here. What I plan is the following : - add the new ldap server - setup a multi-master replication with the old master - move the replica from the old one to the new one - move the write operations from the old one to the new one - disconnect the old one. Does anybody see a flaw in this plan ? f.g.

1 0

Re: Replication in MMR setup
by Quanah Gibson-Mount 09 Feb '21

09 Feb '21

--On Monday, February 8, 2021 10:26 PM -0800 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > > Hi, > > > In an MMR setup (between two servers) if contextCSN on both the servers > is the same, are there any chances that entries count can still differ? Yes, if you started with an older version of OpenLDAP than 2.4.57, and if you use standard syncrepl, and/or you've hit a REFRESH. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Converting OpenLDAP schema to Active Directory LDF
by Kevin Olbrich 09 Feb '21

09 Feb '21

Hi! Is there any known tool to help with converting an openldap schema to AD LDF / LDIF? I need to integrate FreeRADIUS (extended attributes) directly into AD: https://github.com/FreeRADIUS/freeradius-server/blob/master/doc/schemas/lda… In the past, I just created the attributes one by one using the schema manager on windows with values matching the original schema as much as possible. Can this be simplified? Thank you! Kind regards Kevin

1 0

Caching proxy (slapo-pcache) - configuration to cache everything?
by Harsh, Daniel (NonEmp) 08 Feb '21

08 Feb '21

Hello, I am looking to configure OpenLDAP as a caching proxy to a non-OpenLDAP backend. The idea is to deploy this proxy in various sites that may have spotty network connectivity to provide some level of availability should the upstream LDAP service be unavailable. Unfortunately, my requirements preclude a more elegant solution using replication/sync, so the next best idea I can come up with is a caching proxy idea. Is it possible to configure the proxy to cache all queries without having to define separate pcacheTemplate directives for each possible search filter that a client could use? Regards, Dan ________________________________ This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain information that is confidential and protected by law from unauthorized disclosure. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

1 0

How to restrict access to operational attributes?
by Uwe Sauter 08 Feb '21

08 Feb '21

Good morning, I'm trying to restrict access to the operational attributes that are provided by the ppolicy overlay (e.g. pwdChangedTime, pwdHistory). When I add the following to my ACL configuration file and try to verify the configuration an error occurs: #### ACL access to attrs=pwdHistory by * none ######## #### slaptest output 601cf554 /etc/openldap/acl.conf: line 96: unknown attr "pwdHistory" in to clause 601cf554 <access clause> ::= access to <what> [ by <who> [ <access> ] [ <control> ] ]+ <what> ::= * | dn[.<dnstyle>=<DN>] [filter=<filter>] [attrs=<attrspec>] <attrspec> ::= <attrname> [val[/<matchingRule>][.<attrstyle>]=<value>] | <attrlist> <attrlist> ::= <attr> [ , <attrlist> ] <attr> ::= <attrname> | @<objectClass> | !<objectClass> | entry | children <who> ::= [ * | anonymous | users | self | dn[.<dnstyle>]=<DN> ] [ realanonymous | realusers | realself | realdn[.<dnstyle>]=<DN> ] [dnattr=<attrname>] [realdnattr=<attrname>] [group[/<objectclass>[/<attrname>]][.<style>]=<group>] [peername[.<peernamestyle>]=<peer>] [sockname[.<style>]=<name>] [domain[.<domainstyle>]=<domain>] [sockurl[.<style>]=<url>] [dynacl/<name>[/<options>][.<dynstyle>][=<pattern>]] [ssf=<n>] [transport_ssf=<n>] [tls_ssf=<n>] [sasl_ssf=<n>] <style> ::= exact | regex | base(Object) <dnstyle> ::= base(Object) | one(level) | sub(tree) | children | exact | regex <attrstyle> ::= exact | regex | base(Object) | one(level) | sub(tree) | children <peernamestyle> ::= exact | regex | ip | ipv6 | path <domainstyle> ::= exact | regex | base(Object) | sub(tree) <access> ::= [[real]self]{<level>|<priv>} <level> ::= none|disclose|auth|compare|search|read|{write|add|delete}|manage <priv> ::= {=|+|-}{0|d|x|c|s|r|{w|a|z}|m}+ <control> ::= [ stop | continue | break ] dynacl: <name>=ACI <pattern>=<attrname> slaptest: bad configuration file! #################### My questions: * How can I restrict access to operational attributes? Does this depend on the specific overlay? * Is this a bug in the ppolicy overlay? One might consider the pwd* attributes confidential but at the same time allowing anonymous queries might be necessary. * Is there anything I miss (besides still using configuration files – they are way easier to handle)? Best, Uwe

5 13

OpenLDAP 2.5.1 ALPHA released
by Quanah Gibson-Mount 08 Feb '21

08 Feb '21

Hello -technical, The second alpha release for the OpenLDAP 2.5 series released today, and the source can be obtained from the download page: <https://www.openldap.org/software/download/> The OpenLDAP 2.5 series contains numerous bug fixes and enhancements. Note that this release includes the new load balancer functionality. A list of issues marked complete for this alpha can be found in Bugzilla: <https://bugs.openldap.org/buglist.cgi?bug_status=VERIFIED&list_id=858&produ…> Any testing in dev/qa/test environments that people can engage in with this alpha would be extremely helpful. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Best way two update a full OpenLDAP database from LDIF file
by Prunk Dump 06 Feb '21

06 Feb '21

Hello ! My network infrastructure uses some special database not compatible with LDAP. But I need an OpenLDAP server to administer my Web Services accounts on my DMZ. So I have written a script to export our "special" database to an LDIF file. This works pretty well. I've successfully loaded it on my OpenLDAP server. But now I don't know how to update my OpenLDAP database from the new generated LDIF files (when users are added, updated or removed) without disturbing the whole LDAP service (it's not a very good idea to delete the entire database and recreate it from the new LDIF file as it stop the service completely during the operation). Is there a way to update an OpenLDAP database to fit a new given LDIF file ? -> Updating/deleting the OUs -> Deleting the objects that are not present. -> Deleting the attributes removed. -> Updating the attributes that have changed without deleting the object. Doing this step by step to disturb as little as possible the OpenLDAP service. Thanks for the help. Regards, Baptiste.

5 6

Re: Upgrade from 2.4.44 to 2.4.55
by Quanah Gibson-Mount 05 Feb '21

05 Feb '21

--On Friday, February 5, 2021 10:51 AM -0800 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > > We use centOS 7 and rely on base repo. > > > openldap-servers-2.4.44-22.el7.x86_64 : LDAP server > Repo : base > > > > openldap-servers-2.4.44-21.el7_6.x86_64 : LDAP server > Repo : @base Symas provides free drop in replacments for the ancient version of OpenLDAP shipped with RHEL7: <https://repo.symas.com/sofl/rhel7/> I suggest using them. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Upgrade from 2.4.44 to 2.4.55
by Quanah Gibson-Mount 05 Feb '21

05 Feb '21

--On Friday, February 5, 2021 10:20 AM -0800 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > > Quanah, > > > We use binaries from OS distribution / repos, i mean do say can i > directly do an inplace upgrade from 2.4.44 to latest version or do i need > to worry about OS related libraries?. Since 2.4.57 is a very young > release I wanted to play safe :) but eventually we will upgrade to .57. > Also if my current installation is using bdb/hdb can i still continue > with those backends with the latest version? If i want to migrate from > bdb/hdb to mdb when upgrading, are there any migration processes for that? What distribution are you using? -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Context CSN timestamp
by Frédéric Goudal 05 Feb '21

05 Feb '21

Hello, I have a strange problem of synchronization, since yesterday my slave servers have a small difference of 2 or 3 minutes with the master. I mean the context CSN of the slave is 3 mn earlier than contextCSN of the master. My first question is the following : how the timestamp of the contextCSN of the slave is computed ? Is it a copy of the tilmestamp from the master ? Or is it based on the localtime of the slaves ? My second question is that maybe such a small difference is « normal » (as the contextCSN of slave is progressing that means that replication is not fully stopped just a bit delayed) and I should only worry for a greater difference of time than one minute. Thanks in advance. Fred

2 1

Re: Upgrade from 2.4.44 to 2.4.55
by Quanah Gibson-Mount 05 Feb '21

05 Feb '21

--On Thursday, February 4, 2021 5:03 PM -0800 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > > Is there any upgrade process to upgrade from 2.4.44 to 2.4.55 ? You should upgrade to 2.4.57. I'm not sure what you mean as far as "upgrade process". Are you using binaries you built yourself? Binaries from a distribution? etc. Generally new dot releases are simply a drop in replacement. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

ldapmodify: wrong attributeType at line N
by Harri T. 05 Feb '21

05 Feb '21

Hi Updating the user attribute "shadowWarning" works fine: # cat tmp4.ldif dn: uid=john,ou=People,dc=example,dc=com changetype: modify replace: shadowWarning shadowWarning: 7 # ldapmodify -H ldapi:/// -D cn=admin,dc=example,dc=com -w ******** -f tmp4.ldif modifying entry "uid=john,ou=People,dc=example,dc=com" When I add the attribute "mail" into ldif the update fails: # cat tmp3.ldif dn: uid=john,ou=People,dc=example,dc=com changetype: modify replace: shadowWarning shadowWarning: 7 replace: mail mail: john.doe(a)example.com # ldapmodify -H ldapi:/// -D cn=admin,dc=example,dc=com -w ******** -f tmp3.ldif ldapmodify: wrong attributeType at line 5, entry "uid=john,ou=People,dc=example,dc=com" What's wrong with the file tmp3.ldif? Kind regards, Harri

4 4

Multi-master provider and delta syncrepl
by paul.jc＠yahoo.com 02 Feb '21

02 Feb '21

Hi all, We are setting up multi-master (3 providers) and are curious if it is recommended to use delta syncrepl between the providers vs standard sync. Currently, we have delta-sync set up between consumers and our single provider. Are there any gotchas with using delta syncrepl for provider-provider replication? I am curious if a new provider is added, does/should the accesslog db get sync'd as well, or does each provider get its own unique accesslog db? And if each accesslog db is unique, how do consumers using delta syncrepl deal with a provider that has sync'd the change in its main db but not in the accesslog? Is this a non-issue if all consumers are aware of all providers and would that mean all consumers have to sync from all providers? I'm sure the answer to this is clear but I am missing it in the docs. Any input or clarification is appreciated. Thanks! Paul

2 1

Unable to bind with LDAP DN having encoded chars
by radiatejava 02 Feb '21

02 Feb '21

I am using openldap client library 2.4.44 on Centos 7.3, LDAP v3 setting. I am having an issue with LDAP bind when the DN has encoded representation of special characters like é (e acute). Actual DN is CN=mithun,OU=Groupes de Sécurité,DC=mytest,DC=net and when it is sent by the app (frontend) to our backend, it is coming as CN=mithun,OU=Groupes de S\u00e9curit\u00e9,DC=insaaadev,DC=net. Basically, é comes encoded as \u00e9 which is as per the encoding mentioned here https://www.fileformat.info/info/unicode/char/e9/index.htm To further try out, I directly hardcoded the DN to CN=mithun,OU=Groupes de S\u00e9curit\u00e9,DC=mytest,DC=net and that worked fine. I want to understand why it fails when the DN in the same format comes from the frontend app. Appreciate your help, thanks.

3 4

Backup/Restore Overlays MemberOf
by Lars Päßler 02 Feb '21

02 Feb '21

Hello, I am running OpenLDAP 2.4.47 on Debian 10 for a while and now I enabled the overlay for memberOf. Is there any good option for backup and restore, because slapcat and slapadd aren't working. Thanks and kind regards Lars

3 2

proxied syncrepl: consumers sometimes missing all kinds of entries
by Udo Rader 01 Feb '21

01 Feb '21

Hi, We're using a proxied sync-repl installation to populate various consumers from our single master. For some time now, we've been seeing all kind of strange phenomenons, mostly with missing objects on some (not all consumers). Previously, our consumers and our master hadn't been identical with regards to the OpenLDAP version and the operating system used. While, according to the specs, this should have worked, we decided to rule out one source of trouble and upgrade our infrastructure and so right now, we're using OpenLDAP 2.4.47 on debian buster on all involved boxes: % dpkg -l slapd [...] ii slapd 2.4.47+dfsg-3+deb10u4 amd64 OpenLDAP server (slapd) One of the issue we're currently seeing is that memberOf queries don't work as expected. Different consumers yield different results, which again are different from what the master has. See for example: # on the master root@minerva:~# ldapsearch -b ou=People,dc=example,dc=com -LLL -x uid=ssebastian memberof dn: uid=ssebastian,ou=People,dc=example,dc=com memberOf: cn=ocp-cluster-users,ou=Group,dc=example,dc=com memberOf: cn=ocp-cluster-admins,ou=Group,dc=example,dc=com memberOf: cn=qube,ou=Group,dc=example,dc=com # consumer #1 root@demeter:~# ldapsearch -b ou=People,dc=example,dc=com -LLL -x uid=ssebastian memberof dn: uid=ssebastian,ou=People,dc=example,dc=com # consumer #2 root@peta:~# ldapsearch -b ou=People,dc=example,dc=com -LLL -x uid=ssebastian memberof dn: uid=ssebastian,ou=People,dc=example,dc=com memberOf: cn=ocp-cluster-users,ou=Group,dc=example,dc=com memberOf: cn=ocp-cluster-admins,ou=Group,dc=example,dc=com However, when I investigate the group, I see the user listed in every one of them: # on the master root@minerva:~# ldapsearch -LLL -x cn=qube dn: cn=qube,ou=Group,dc=example,dc=com objectClass: groupOfNames objectClass: top objectClass: posixGroup cn: qube gidNumber: 1602 [...] member: uid=ssebastian,ou=People,dc=example,dc=com [...] # on consumer #1 root@demeter:~# ldapsearch -LLL -x cn=qube dn: cn=qube,ou=Group,dc=example,dc=com objectClass: groupOfNames objectClass: top objectClass: posixGroup cn: qube gidNumber: 1602 [...] member: uid=ssebastian,ou=People,dc=example,dc=com [...] # on consumer #2 root@peta:~# ldapsearch -LLL -x cn=qube dn: cn=qube,ou=Group,dc=example,dc=com objectClass: groupOfNames objectClass: top objectClass: posixGroup cn: qube gidNumber: 1602 [...] member: uid=ssebastian,ou=People,dc=example,dc=com [...] The master only shares the relevant part of the DIT to the consumers, so unfortunately I cannot 1:1 compare them using slapcat. But if I again apply a group filter, slapcat delivers correct results on all instances as well (ie slapcat -a 'cn=qube') My first idea was an index issue, but running slapindex didn't change anything. Any ideas what might be wrong and/or how to debug this issue? Additionally - bear with me - we're not using cn=config, but the old style slapd.conf configuration. Thanks Udo -- Udo Rader, CTO BestSolution.at EDV Systemhaus GmbH Eduard-Bodem-Gasse 5-7, A-6020 Innsbruck http://www.bestsolution.at/ Reg. Nr. FN 222302s am Firmenbuchgericht Innsbruck

2 2

Re: How to set credential to ldap_gssapi_bind_s?
by Árpád Nagy 29 Jan '21

29 Jan '21

Hello, Thanks for the answer! What function should I use if I must supply username/password and I want to bind using GSSAPI? Is it possible somehow with Open LDAP? Regards, Arpad Quanah Gibson-Mount <quanah(a)symas.com> ezt írta (időpont: 2021. jan. 27., Sze, 18:10): > > > --On Wednesday, January 27, 2021 4:16 PM +0100 Árpád Nagy > <arpadnagy.bp(a)gmail.com> wrote: > > > > > According this it is executed only if 'dn' and 'creds' is NULL. > > My question is how can I set the user name and password which I want to > > authenticate on LDAP server? > > Using GSSAPI implies that the connecting client already has access to a > kerberos5 ticket, which is used for the authentication step and thus there > is no username or password to be supplied. > > If you must supply a username/password, then you're using the wrong > function. > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

OpenLDAP proxy to AD with client certificates
by David Cunningham 28 Jan '21

28 Jan '21

Hello, I would like to configure slaps.conf to proxy requests to an AD server. 1.) I want SLAPD to always connect to this AD server as a specific user 2.) I want SLAPD to run all queries including searches against this AD server using the defined user. 3.) I want clients connecting to SLAPD to query AD to be authenticated by revokable client certificate only. If the connecting client has a valid certificate that matches a CA, then it’s LDAP query is allowed and proxied to Active Directory. 4.) The client should also be able to rebind as user after doing a user DN search (to verify username/password). Does that make sense?

2 2

How to set credential to ldap_gssapi_bind_s?
by Árpád Nagy 27 Jan '21

27 Jan '21

Hello, I try to bind to LDAP server using GSSAPI. I try to use ldap_gssapi_bind_s method (gssapi.c): int ldap_gssapi_bind_s( LDAP *ld, LDAP_CONST char *dn, LDAP_CONST char *creds ) { if ( dn != NULL ) { return LDAP_NOT_SUPPORTED; } if ( creds != NULL ) { return LDAP_NOT_SUPPORTED; } return ldap_int_gss_spnego_bind_s(ld); } According this it is executed only if 'dn' and 'creds' is NULL. My question is how can I set the user name and password which I want to authenticate on LDAP server? Regards, Arpad

2 1

Read-only access on all the directory to a certain user
by Harri T. 26 Jan '21

26 Jan '21

Hi, Could someone please give an example of .ldif for granting *read-only* access on all the directory to the user "cn=query,dc=example,dc=com"? Kind regards, Harri

2 4

Syncprov shows issue with entry
by Nick Milas 25 Jan '21

25 Jan '21

Hello, I would like to ask you for your guidance regarding the following. We have an openldap (v2.4.56) master server syncing with three other openldap slaves. The master seems being unable to complete successfully syncing a particular entry and it keeps trying for ever. Logs follow. I have realized this only now, but it seems that this is happening for long. (It is recorded in all the logs I have available.) What is the suggested way to resolve this situation? ======================================================================================================= ... Jan 16 14:48:09 ldap.noa.gr slapd[1655]: conn=1048 op=1 syncprov_search_response: Entry cn=thermo,ou=Aliases,dc=noa,dc=gr CSN 20200910151806.461875Z#000000#000#000000 older or equal to ctx 20200910151806.461875Z#000000#000#000000 Jan 16 14:48:09 ldap.noa.gr slapd[1655]: conn=1048 op=1 syncprov_search_response: cookie=rid=601,csn=20210116055411.875566Z#000000#000#000000 Jan 16 14:48:09 ldap.noa.gr slapd[1655]: conn=1048 op=1 syncprov_sendinfo: refreshPresent cookie=rid=601,csn=20210116055411.875566Z#000000#000#000000 Jan 16 14:48:09 ldap.noa.gr slapd[1655]: conn=1048 op=1 syncprov_search_response: detaching op Jan 16 14:51:09 ldap.noa.gr slapd[1655]: conn=1058 op=1 syncprov_op_search: got a persistent search with a cookie=rid=601,csn=20200910151806.461875Z#000000#000#000000 Jan 16 14:51:09 ldap.noa.gr slapd[1655]: conn=1058 op=1 syncprov_findbase: searching Jan 16 14:51:09 ldap.noa.gr slapd[1655]: conn=1058 op=1 syncprov_op_search: registered persistent search Jan 16 14:51:09 ldap.noa.gr slapd[1655]: conn=1058 op=1 syncprov_findcsn: mode=FIND_CSN csn=20200910151806.461875Z#000000#000#000000 Jan 16 14:51:09 ldap.noa.gr slapd[1655]: conn=1058 op=1 syncprov_findcsn: csn==20200910151806.461875Z#000000#000#000000 found Jan 16 14:51:09 ldap.noa.gr slapd[1655]: conn=1058 op=1 syncprov_findcsn: mode=FIND_PRESENT csn= Jan 16 14:51:09 ldap.noa.gr slapd[1655]: conn=1058 op=1 syncprov_sendinfo: present syncIdSet cookie= Jan 16 14:51:09 ldap.noa.gr slapd[1655]: conn=1058 op=1 syncprov_sendinfo: present syncIdSet cookie= Jan 16 14:51:09 ldap.noa.gr slapd[1655]: conn=1058 op=1 syncprov_sendinfo: present syncIdSet cookie= Jan 16 14:51:09 ldap.noa.gr slapd[1655]: conn=1058 op=1 syncprov_sendinfo: present syncIdSet cookie= Jan 16 14:51:09 ldap.noa.gr slapd[1655]: conn=1058 op=1 syncprov_sendinfo: present syncIdSet cookie= Jan 16 14:51:09 ldap.noa.gr slapd[1655]: conn=1058 op=1 syncprov_sendinfo: present syncIdSet cookie= Jan 16 14:51:09 ldap.noa.gr slapd[1655]: conn=1058 op=1 syncprov_sendinfo: present syncIdSet cookie= Jan 16 14:51:09 ldap.noa.gr slapd[1655]: conn=1058 op=1 syncprov_sendinfo: present syncIdSet cookie= Jan 16 14:51:09 ldap.noa.gr slapd[1655]: conn=1058 op=1 syncprov_sendinfo: present syncIdSet cookie= Jan 16 14:51:09 ldap.noa.gr slapd[1655]: conn=1058 op=1 syncprov_sendinfo: present syncIdSet cookie= Jan 16 14:51:09 ldap.noa.gr slapd[1655]: conn=1058 op=1 syncprov_sendinfo: present syncIdSet cookie= Jan 16 14:51:09 ldap.noa.gr slapd[1655]: conn=1058 op=1 syncprov_sendinfo: present syncIdSet cookie= Jan 16 14:51:09 ldap.noa.gr slapd[1655]: conn=1058 op=1 syncprov_search_response: Entry cn=thermo,ou=Aliases,dc=noa,dc=gr CSN 20200910151806.461875Z#000000#000#000000 older or equal to ctx 20200910151806.461875Z#000000#000#000000 Jan 16 14:51:09 ldap.noa.gr slapd[1655]: conn=1058 op=1 syncprov_search_response: cookie=rid=601,csn=20210116055411.875566Z#000000#000#000000 Jan 16 14:51:09 ldap.noa.gr slapd[1655]: conn=1058 op=1 syncprov_sendinfo: refreshPresent cookie=rid=601,csn=20210116055411.875566Z#000000#000#000000 Jan 16 14:51:09 ldap.noa.gr slapd[1655]: conn=1058 op=1 syncprov_search_response: detaching op ========================================================================================================= Thank you in advance for your advice! Cheers, Nick

3 4

openldap performance problems
by Zetan Drableg 25 Jan '21

25 Jan '21

Every time my "updater" process writes an LDIF to LDAP, clients start seeing timeouts during authentication. Even with a small number of inserts or removals, this problem shows up. openldap 2.4.47, MBD, 16 core Linux server, 6 nodes in a n-way multimaster replication configuration. The on disk database is 1.5gigs. Can anyone suggest tunables for this problem? I've tried "threads 64" but that didn't improve things. [2021-01-24 00:01:45] connection_input: conn=2721465 deferring operation: binding [2021-01-24 00:01:45] connection_input: conn=2721505 deferring operation: binding [2021-01-24 00:01:45] connection_read(17): no connection! [2021-01-24 00:01:46] connection_input: conn=2721694 deferring operation: binding [2021-01-24 00:01:47] connection_input: conn=2721844 deferring operation: binding [2021-01-24 00:01:48] connection_input: conn=2722210 deferring operation: binding [2021-01-24 00:01:48] connection_input: conn=2722208 deferring operation: binding [2021-01-24 00:01:48] connection_input: conn=2722283 deferring operation: binding Thank you

2 1

openldap mdb tuning
by olivier.chirossel＠sfr.com 22 Jan '21

22 Jan '21

Hi guys, I have an architecture with : 2 masters ( refresh and persist ) a load balanceur in front of the masters (vip main/sorry), to avoid write in the same time on the masters (stability) few consumers use back-mdb openldap version 2.4.45 my huge branche 3181406 entries, data.mdb 7.7G on the main master, 9.1G on the consumers and the sorry master ( use du -h to get the size ) I have three questions : why the size is smaller on the main master ? Sometimes i have to scripts a lot of ldapmodify ( ~100000 ), should i have to set olcDbEnvFlags: writemap olcDbEnvFlags: nometasync for increase performance ? This sets is recommended for production ? stability issues with theses set ? i have no stability issue for now, but considering this two questions, is it recommended to upgrade ? thank's in advance regards Olivier

3 4

Use-case specific changes to LMDB
by martin＠urbackup.org 22 Jan '21

22 Jan '21

This post outlines a few changes to LMDB I had to do to make it work in a specific use case. I’d like to see those changes upstream, but I understand that they may be/are not relevant for e.g. OpenLDAP. The use case is multiple databases on disks with long running large write transactions. 1. Option to not use custom memory allocator/page pool LMDB has a custom malloc() implementation that re-uses pages (me_dpages). I understand that this improves the performance at bit (depending on the malloc implementation). But there should at least be the option to not do that (for many reasons). I would even make not using it the default. 2. Large transactions and spilling In a large write transaction, it will use a lot of memory per default (512MiB) which won’t get freed when the transaction commits (see 1.). If one has a lot of databases it uses a lot of memory that never gets freed. Alternatively, one can use MDB_WRITEMAP, but (i) per default Linux isn’t tuned to delay writing pages to disk and (ii) before commit LMDB has to remove a dirty bit, so each page is written twice. Both problems would be fixed by making when pages get spilled configurable (mt_dirty_room as MDB_IDL_UM_MAX currently) and reducing the default non-spill memory amount for at least the MDB_WRITEMAP case. If this memory amount is low mt_spill_pgs gets sorted often so maybe this needs to be converted to a different data structure (e.g. red-black tree). 3. LMDB causes crashes if database is corrupted If the database is corrupted it can cause the application to crash. I have fixed those cases when they (randomly) occurred. Properly fixing this would probably be best done with some fuzzing. 4. Allow LMDB to reside on a device I used dm-cache to improve LMDB read performance. It needed a bit of adjustment to get the correct size of the device via ioctl BLKGETSIZE64. -- I’ve fixed those issues w.r.t. my application. If there is interest in any of those application specific changes, I’ll clean them up and post them.

4 6

Symas OpenLDAP For Linux 2.4.57 released
by Quanah Gibson-Mount 20 Jan '21

20 Jan '21

The latest version of Symas OpenLDAP for Linux is now available for RHEL7, RHEL8, Ubuntu18 LTS, and Ubuntu 20 LTS. <https://repo.symas.com/sofl/> for installation instructions. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

LTB packages (was: OpenLDAP 2.4.57 available)
by Clément OUDOT 19 Jan '21

19 Jan '21

Le 18/01/2021 à 21:21, project(a)openldap.org a écrit : > OpenLDAP 2.4.57 is now available for download as detailed on our download page: LDAP Tool Box packages are available for Debian stretch / Debian buster / CentOS 7 / CentOS 8 See https://ltb-project.org/download#openldap -- Clément Oudot | Identity Solutions Manager clement.oudot(a)worteks.com Worteks | https://www.worteks.com

1 0

openSUSE/SLE package update (was: OpenLDAP 2.4.57 available)
by Michael Ströder 19 Jan '21

19 Jan '21

On 1/18/21 9:21 PM, project(a)openldap.org wrote: > OpenLDAP 2.4.57 is now available for download as detailed on our download page: FWIW: openSUSE/SLE devel package has also been updated: https://build.opensuse.org/package/show/network:ldap/openldap2 Ciao, Michael.

1 0

OpenLDAP with GSSAPI on Windows
by Árpád Nagy 19 Jan '21

19 Jan '21

Hello, I try to use OpenLDAP with GSSAPI for authentication on Windows platform and the LDAP server is a Microsoft AD. According to the OpenLDAP Admin guide the SASL have to be used. SASL plugin is for OpenLDAP the Cyrus SASL. In the Cyrus SASL 2.1.27 package the description "Building Cyrus SASL on Windows" is very outdated. Is it possible to build a working solution with Cyrus SASL 2.1.27 , MIT Kerberos 5 and OpenLDAP 2.4.56 for Windows x64 platform with Microsoft Visual Studio 2017 to authenticate Windows client with GSSAPI? Regards, Arpad

1 0

availability of openLDAP 2.4.56 for centos 7.8/7.9
by shelke.sachitanand＠gmail.com 18 Jan '21

18 Jan '21

Hi Team, Does latest release (openLDAP 2.4.56) is supported for Centos 7.8/7.9 ? I tried to install openLDAP rpms (openldap, openldap-servers, openldap-clients) on Centos 7.8 but observed lot of dependencies failures also observed same issue when I tried to upgrade existing Openldap(openldap-2.4.44-22.el7.x86_64) to this latest rpm. Can someone help me on this. If this version is not supported then can we build and create rpm from openldap source code. Thanks, Sachitanand

4 7

LMDB: What goes "wrong" when a process is suspended during a transaction?
by Antti K 17 Jan '21

17 Jan '21

Good evening from Germany. The LMDB "Caveats" documentation mentions: > Avoid suspending a process with active transactions. These would then be > "long-lived" as above. Also read transactions suspended when writers commit > could sometimes see wrong data. Questions: - What does "wrong data" mean? What guarantees are broken? Is potentially undefined behaviour ("read returns junk"), or isolation weakening ("transaction reads value actually written after the transaction started"), or something else? - If I do find myself in that unfortunate situation, how screwed am I? For example, say someone spelled SIGSTP wrong, and suspended my program with an uncatchable SIGSTOP instead, and so I could not wait for transactions to complete before being suspended. My program simply catches a SIGCONT, with transactions in flight. What can it do to maintain correctness? Guidance kindly appreciated. -- Antti

2 1

Bind to OpenLDAP with a user not in DN format
by gary.algier＠mavenir.com 17 Jan '21

17 Jan '21

Hello, I need to bind sometimes with a username that is not in DN format. I have tried to use authz-regexp to translate it but I am not successful. I have created a few entries and I can authenticate with the Manager DN. I can also authenticate with other entries when I explicitly use a DN, but when I use something that does not start with "dn=", it fails. I have this entry that I want to use for authentication: dn: cn=ServiceAccount(a)old-domain.com,dc=old-domain,dc=Com cn: ServiceAccount(a)old-domain.com sn: ServiceAccount(a)old-domain.com objectClass: person userPassword: {hidden} When I use the full DN as an argument of the -D option of ldapsearch it works. I have this in slapd.conf: authz-regexp uid=([^,]*).*,cn=auth cn=$1,dc=old-domain,dc=Com When I run: slapauth ServiceAccount(a)old-domain.com I see: ID: <ServiceAccount(a)old-domain.com> check succeeded authcID: <cn=ServiceAccount(a)old-domain.com,dc=old-domain,dc=com> So it looks like it can translate. But when I try to use: ldapsearch -x -DServiceAccount(a)old-domain.com ... I get: ldap_bind: Invalid DN syntax (34) additional info: invalid DN I have a system that sends the "service account" for user searches in this format. I.E. not a DN. I can't change the client. Does anyone have any ideas why SLAPD does not translate? Or do I need to turn on a "allow non-DNs" switch? Or is it actually the ldapsearch command that is complaining. If the latter, is there a way to test? Gary

3 4

Support of signing requirement on Windows
by Árpád Nagy 15 Jan '21

15 Jan '21

Hi Team, Does latest release (OpenLDAP 2.4.56) support LDAP signing requirement for Windows 10 / Windows Server 2016? Currently in our project we have a 32 bit Windows Service which use the OpenLDAP libldaplber.dll for simple bind to Microsoft AD server. Now we have a new requirement to support signing requirement on Windows environment (Windows AD). Therefore instead of simple bind we have to use GSSAPI for LDAP bind as I understand. I am relative new with OpenLDAP and my further question is that OpenLDAP supports this scenario on Windows? Thanks in advance! Regards, Arpad

1 0

The NULL into the description (text) error message.
by Pavel Demidov 15 Jan '21

15 Jan '21

Hello, I'm using OpenLdap 2.4.44 with delta-replication. At the master node i get the error messages. RESULT tag=103 err=19 text=Password is in history of old password at the slave node RESULT tag=103 err=19 text= Are any way to get full text message at the slave node Cheers, Paddey

1 0

Replicating users from OpenLDAP server to another
by Harri T. 15 Jan '21

15 Jan '21

Hi, Is it possible to integrate two OpenLDAP servers so that some users (filtered by some criteria) are replicated from one server to another (but not vice versa)? Does OpenLDAP provide some functionalties for this or must I write a cron scheduled shell script utilizing ldapsearch and ldapmodify? Any advice or configuration example is appreciated. Kind regards, Harri

3 4

ldap_modify: Undefined attribute type (17)
by CLARKE, ED C 14 Jan '21

14 Jan '21

Hello, While trying to reset a user's password, I am getting the below error: ldap_modify: Undefined attribute type (17) additional info: pwdReset: attribute type undefined the same script runs fine on our other LDAP server, your thoughts? Here is a copy of the ldif file: dn: uid=foxdiv,ou=People,dc=att,dc=com changetype: modify replace: pwdReset pwdReset: TRUE - replace: userPassword userPassword: xxxxxxxxx Thanks, Ed Ed Clarke Senior Software Engineer Operations Transformation, Real-time Automation & Predictive Insights<http://mysolutions.dev.att.com/GNFO_Solutions/index.jsp> "RAPID" Certified Quality Eng. - ISO 9000/1 Six Sigma - Yellow Belt AT&T Veterans AT&T "ATO" 1010 Pine ST. Shared, St. Louis, MO. 63101 m 636.639.0713 | o 314.335.3158 | ec4397(a)att.com<mailto:ec4397@att.com>

2 1

OpenLDAP proxy to AD but local authentication for search
by Gary Algier 12 Jan '21

12 Jan '21

Hello, I have installed the LDAP Tool Box version of OpenLDAP on Centos8 for the purpose of a proxy to AD. My proxy needs to "translate" from our old AD domain to our new AD domain (I hate company name changes!). We have some software that access our old domain with certain credentials, does searches for groups and users then binds as the appropriate user to authenticate the user. From this legacy system I need to be able to: 1. Bind to the proxy with credentials I can't change. These look like user "special-user(a)old.com". (Not a typical DN, looks more like a user principal). 2. Search a particular subtree for users and bind as that user to authenticate. 3. Search another subtree for groups and use an ad-style membership check to determine who is a user, who is an admin, etc. I need to be able to authenticate for the searching using the above special user, but the proxy operation should use a different set of credentials when searching the backend. I also need to translate subtrees and possibly individual DNs. This is my (sanitized) slapd.conf: ------------------------------------------------- include /usr/local/openldap/etc/openldap/schema/core.schema include /usr/local/openldap/etc/openldap/schema/cosine.schema include /usr/local/openldap/etc/openldap/schema/inetorgperson.schema include /usr/local/openldap/etc/openldap/schema/misc.schema include /usr/local/openldap/etc/openldap/schema/nis.schema pidfile /usr/local/openldap/var/run/slapd.pid argsfile /usr/local/openldap/var/run/slapd.args database mdb maxsize 1073741824 suffix "dc=old-domain,dc=com" rootdn "cn=Manager,dc=old-domain,dc=com" rootpw secret directory /usr/local/openldap/var/openldap-data index objectClass eq database meta suffix "dc=old-domain,dc=com" readonly yes protocol-version 3 uri "ldap://dc1:3268,ldap://dc2:3268" suffixmassage "ou=old-tree,DC=old-domain,DC=com" "ou=new-tree,DC=new-domain,DC ------------------------------------------------- I figured out what I think should be done in translating domains, subtrees, etc. What I can't figure out is how to accept the "special-user(a)old.com" on the front and then use another "Service Account" through the backed so I can search for users. Once the frontend rebinds with the user's credentials, that needs to pass through. Can anyone help me have a "split personality" when it comes to authentication? Gary A. Algier E-mail: Gary.Algier(a)Mavenir.com ________________________________ This e-mail message may contain confidential or proprietary information of Mavenir Systems, Inc. or its affiliates and is intended solely for the use of the intended recipient(s). If you are not the intended recipient of this message, you are hereby notified that any review, use or distribution of this information is absolutely prohibited and we request that you delete all copies in your control and contact us by e-mailing to security(a)mavenir.com. This message contains the views of its author and may not necessarily reflect the views of Mavenir Systems, Inc. or its affiliates, who employ systems to monitor email messages, but make no representation that such messages are authorized, secure, uncompromised, or free from computer viruses, malware, or other defects. Thank You

1 0

delta-syncrepl and accesslog backup
by paul.jc＠yahoo.com 08 Jan '21

08 Jan '21

Hello all, I am migrating to delta-syncrepl and have a couple questions. I currently back-up my data.mdb file for restore purposes (using mdb_copy). Now that I am using delta-syncrepl, do I also need to be concerned with the accesslog data.mdb file in the event of a restore? What is the sync behavior of a consumer if it is configured to use delta-syncrepl and the provider is restored but not the accesslog?(i.e. the accesslog would be new on initial start of slapd after a restore)? Files in question: /var/lib/ldap/data.mdb /var/lib/ldap/accesslog/data.mdb Thanks for any input, Paul

3 3

How to clear a certificate from openldap cache - Client Side
by divyachauhan01.dc＠gmail.com 29 Dec '20

29 Dec '20

Divyanshi Chauhan <divyachauhan01.dc(a)gmail.com> 1:33 PM (3 hours ago) to openldap-technical-owner, openldap-devel-owner, openldap-bugs-owner Hello, I have an ldaps client code which connects to the ldap server securely and does authentication. I have set the global option for ca cert directory. int res = ldap_set_option(0, LDAP_OPT_X_TLS_CACERTFILE, const_cast<char*>("path")); Correct certificate is present in the path and hence connection to the ldap server and authentication is successful in first attempt. Now, as per one of the requirements, the certificate is removed from the above client directory and authentication is attempted, we want it to fail as the certificate is deleted from the directory. But still the bind to ldap server and authentication is happening successfully. It should ideally fail as per my understanding. I did try removing the certificate from memory using following option: char * crt; ldap_get_option(0, LDAP_OPT_X_TLS_CACERTFILE, (void*)&crt); ldap_memfree(crt); I am not sure if the above way is correct or not, please advise. I also did try forcing to look for ca certificate using following option: int reqcert = LDAP_OPT_X_TLS_HARD; ldap_set_option(0, LDAP_OPT_X_TLS_REQUIRE_CERT, &reqcert); But this also did not help. Please suggest how a certificate, which is once loaded can be deleted from the openldap cache. Also please advise if I am doing something wrong in the above approach.

2 3

Using supportedControl 1.3.6.1.4.1.4203.1.10.1 (Subentries) - critical extension is unavailable 12
by Gavin Henry 27 Dec '20

27 Dec '20

Hi all, I'm doing this for a supportControl subentry delete: https://metacpan.org/pod/Net::LDAP::Control like so: my $subentry_ctrl = Net::LDAP::Control->new( type => '1.3.6.1.4.1.4203.1.10.1', value => 'Subentries', critical => 1 ); my $deleted = $c->model('LDAPContacts')->delete( q{ou=Contacts,} . $user_dn, control => [ $subentry_ctrl ] ); if ( $deleted->code ) { $c->error( qq{Failed to delete LDAP contact entries for: $user_dn} . $deleted->error . q{ Code: } . $deleted->code ); return 0; } and I'm getting: Dec 22 12:53:57 gabriel slapd[31511]: conn=1110022 op=2 SRCH attr=dn Dec 22 12:53:57 gabriel slapd[31511]: conn=1110022 op=2 ENTRY dn="xxxx" Dec 22 12:53:57 gabriel slapd[31511]: conn=1110022 op=2 SEARCH RESULT tag=101 err=0 qtime=0.000010 etime=0.001015 nentries=1 text= Dec 22 12:53:57 gabriel slapd[31511]: conn=1110023 fd=435 ACCEPT from IP=xxx:51082 (IP=0.0.0.0:389) Dec 22 12:53:57 gabriel slapd[31511]: conn=1110023 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Dec 22 12:53:57 gabriel slapd[31511]: conn=1110023 op=0 STARTTLS Dec 22 12:53:57 gabriel slapd[31511]: conn=1110023 op=0 RESULT oid= err=0 qtime=0.000007 etime=0.000038 text= Dec 22 12:53:57 gabriel slapd[31511]: conn=1110023 fd=435 TLS established tls_ssf=256 ssf=256 tls_proto=TLSv1.3 tls_cipher=TLS_AES_256_GCM_SHA384 Dec 22 12:53:57 gabriel slapd[31511]: conn=1110023 op=1 BIND dn="xxx" method=128 Dec 22 12:53:57 gabriel slapd[31511]: conn=1110023 op=1 BIND dn="xxx" mech=SIMPLE ssf=0 Dec 22 12:53:57 gabriel slapd[31511]: conn=1110023 op=1 RESULT tag=97 err=0 qtime=0.000017 etime=0.000116 text= Dec 22 12:53:58 gabriel slapd[31511]: conn=1110023 op=2 RESULT tag=107 err=12 qtime=0.000014 etime=0.000274 text=critical extension is unavailable Dec 22 12:53:58 gabriel slapd[31511]: conn=1110023 op=2 do_delete: get_ctrls failed Any ideas? Using ldapdelete with -r works as the same user (so not my ACLs), but I note in the logs that it is doing a base search for subentries and deleting each one. What am I misunderstanding here? Thanks, Gavin.

1 1

Bind using External/Client certificate not working - slapd returns binding in progress..
by dumitru s 27 Dec '20

27 Dec '20

Hi all, I'm using openldap/slapd as a ldap server (using libsasl2-2 & related modules for sasl auth) on ubuntu and trying to get a client to authenticate/bind using external/client certificate. I'm using two clients - one is a native C client using windows winldap native library and one is based on a different client ldap library (i.e. not using winldap or openldap native libraries). The client based on winldap works fine, but not the other one. This is what I can see in the slapd logs for the two cases: - the one which works fine via winldap 5fe876d4 conn=1000 op=0 do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt ({m) ber: ber_scanf fmt (m) ber: ber_scanf fmt (}}) ber: 5fe876d4 >>> dnPrettyNormal: <> 5fe876d4 <<< dnPrettyNormal: <>, <> 5fe876d4 do_bind: dn () SASL mech EXTERNAL 5fe876d4 ==>slap_sasl2dn: converting SASL name email=test(a)test.com,cn=example,ou=example,o=example,st=anystate,c=us to a DN 5fe876d4 ==> rewrite_context_apply [depth=1] string='email=test(a)test.com,cn=example,ou=example,o=example,st=anystate,c=us' 5fe876d4 ==> rewrite_rule_apply rule='email=test(a)test.com,cn=example,ou=example,o=example,st=anystate,c=us' string='email=test(a)test.com,cn=example,ou=example,o=example,st=anystate,c=us' [1 pass(es)] 5fe876d4 ==> rewrite_context_apply [depth=1] res={0,'cn=test,dc=example,dc=com'} 5fe876d4 slap_parseURI: parsing cn=test,dc=example,dc=com ldap_url_parse_ext(cn=test,dc=example,dc=com) 5fe876d4 >>> dnNormalize: <cn=test,dc=example,dc=com> 5fe876d4 <<< dnNormalize: <cn=test,dc=example,dc=com> 5fe876d4 <==slap_sasl2dn: Converted SASL name to cn=test,dc=example,dc=com 5fe876d4 slap_sasl_getdn: dn:id converted to cn=test,dc=example,dc=com 5fe876d4 SASL Authorize [conn=1000]: proxy authorization allowed authzDN="" 5fe876d4 send_ldap_sasl: err=0 len=-1 5fe876d4 do_bind: SASL/EXTERNAL bind: dn="cn=test,dc=example,dc=com" sasl_ssf=0 5fe876d4 send_ldap_response: msgid=1 tag=97 err=0 - the one which doesn't work 5fe87b50 conn=1001 op=0 do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt ({m) ber: ber_scanf fmt (}}) ber: 5fe87b50 >>> dnPrettyNormal: <> 5fe87b50 <<< dnPrettyNormal: <>, <> 5fe87b50 do_bind: dn () SASL mech EXTERNAL 5fe87b50 send_ldap_sasl: err=14 len=0 5fe87b50 send_ldap_response: msgid=1 tag=97 err=14 As can be seen, the second one stops at "do_bind: dn () SASL mech EXTERNAL" and slapd just returns the binding in progress result code. Of course, the same client certificate is used in both cases. The fact that one client works fine suggests that the slapd configuration is correct. Any idea what is wrong? Can I enable any additional logs (sasl one?) to be able to see more? Thanks, Dumitru

1 0

Migrate HDB to MDB
by Pete Ashdown 21 Dec '20

21 Dec '20

I'm looking for some assistance in converting a legacy LDAP from an HDB backend to MDB. I've been unable to find any resources in how this can be executed and my attempts at using ldapmodify have failed. I'm willing to pay consulting fees if someone is available to help, or otherwise be educated if is documented somewhere. Thanks in advance.

3 3

ACL for authz-regexp
by Stefan Kania 20 Dec '20

20 Dec '20

Hello, I try to figure out which ACL I need to get the rewriting of the sasl-username working. I have in my slapd.conf the following lines: ---------- authz-regexp uid=(.+),cn=gssapi,cn=auth ldap:///dc=example,dc=net??sub?(uid=$1) ----------- If I do a "ldapwhoami" without any ACL I get what I want: ----------- ptau@provider-stat:~$ ldapwhoami SASL/GSSAPI authentication started SASL username: ptau(a)EXAMPLE.NET SASL SSF: 256 SASL data security layer installed. dn:uid=ptau,ou=users,dc=example,dc=net ----------- As soon as I include my ACLs I get: ------------ ptau@provider-stat:~$ ldapwhoami SASL/GSSAPI authentication started SASL username: ptau(a)EXAMPLE.NET SASL SSF: 256 SASL data security layer installed. dn:uid=ptau,cn=gssapi,cn=auth ------------ So the rewrite of the DN is not working anymore with ACLs. Here are the relevant part of my ACLs. (It's at the beginning of the ACLs) ------------ limits dn.exact="uid=repl-user,ou=users,dc=example,dc=net" size=unlimited time=unlimited limits dn.exact="cn=kdc,ou=kerberos-adm,dc=example,dc=net" size=unlimited time=unlimited limits dn.exact="cn=kadmin,ou=kerberos-adm,dc=example,dc=net" size=unlimited time=unlimited access to dn.base="" by * read access to dn.base="cn=subSchema" by * read access to * by dn.exact="uid=sssd-user,ou=users,dc=example,dc=net" read by dn.exact="uid=ldap-admin,ou=users,dc=example,dc=net" write by dn.exact="uid=repl-user,ou=users,dc=example,dc=net" read by dn.exact="cn=kdc,ou=kerberos-adm,dc=example,dc=net" write by dn.exact="cn=kadmin,ou=kerberos-adm,dc=example,dc=net" write by dn.regex="(.+),cn=gssapi,cn=auth" auth by * break ------------ As soon as I remove the line: ------------ by dn.regex="(.+),cn=gssapi,cn=auth" auth ------------ and change the last line to: ------------- by * auth ------------- But this will make all other ACLs, after this ACLs, useless. I tried so far: by ssf=256 auth by sasl_ssf=256 auth non of the above is working So it's definitely an ACL issue, but how do I solve it? The log-File is giving me the following output: -------------- Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 fd=20 ACCEPT from IP=192.168.56.81:50728 (IP=0.0.0.0:636) Dez 20 19:22:46 provider-stat ldapwhoami[2047]: GSSAPI client step 1 Dez 20 19:22:46 provider-stat ldapwhoami[2047]: GSSAPI client step 1 Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 fd=20 TLS established tls_ssf=256 ssf=256 Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 op=0 BIND dn="" method=163 Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 op=0 RESULT tag=97 err=14 text=SASL(0): successful result: Dez 20 19:22:46 provider-stat ldapwhoami[2047]: GSSAPI client step 1 Dez 20 19:22:46 provider-stat slapd[2038]: connection_input: conn=1004 deferring operation: binding Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 op=1 BIND dn="" method=163 Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 op=1 RESULT tag=97 err=14 text=SASL(0): successful result: Dez 20 19:22:46 provider-stat ldapwhoami[2047]: GSSAPI client step 2 Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 op=2 BIND dn="" method=163 Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 op=2 BIND authcid="ptau" authzid="ptau" Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 op=2 BIND dn="uid=ptau,cn=gssapi,cn=auth" mech=GSSAPI sasl_ssf=256 ssf=256 Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 op=2 RESULT tag=97 err=0 text= Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 op=3 EXT oid=1.3.6.1.4.1.4203.1.11.3 Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 op=3 WHOAMI Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 op=3 RESULT oid= err=0 text= Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 op=4 UNBIND Dez 20 19:22:46 provider-stat slapd[2038]: conn=1004 fd=20 closed Dez 20 19:22:46 provider-stat ldapwhoami[2047]: DIGEST-MD5 common mech free -------------- I think it had something to do with what I found in the manpage: ------------------- Some internal operations and some controls require specific access privileges. The authzID mapping and the proxyAuthz control require auth (=x) privileges on all the attributes that are present in the search filter of the URI regexp maps (the right-hand side of the authz-regexp directives). Auth (=x) privileges are also required on the authzTo attribute of the authorizing identity and/or on the au‐ thzFrom attribute of the authorized identity. In general, when an internal lookup is performed for authentication or authorization purposes, search-specific privileges (see the access requirements for the search operation illustrated above) are relaxed to auth. ------------------- But my problem here is, I'm not a native English speaker and it's hard for me to figure out what the write is telling me here :-( Any solution for the right ACL to solve the problem? Greetings Stefan

2 1

How to set cipher
by Puranjay Pradhan 17 Dec '20

17 Dec '20

I am trying to set cipher list as like below : std::string ciphers = "AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA" returnCode = ldap_set_option(NULL, LDAP_OPT_X_TLS_CIPHER_SUITE, ciphers.c_str()); But, it returns an error : "TLS could not set cipher list ....." Can anyone suggest what is the right way of doing this?

3 2

verify openldap source
by A. Schulze 17 Dec '20

17 Dec '20

Hello, I'm searching for a way to verify the integrity of downloads from openldap.org. Many open source projects use to provide foo-$version.tar.gz.[asc|sha256sum] next to foo-$version.tar.gz Is something similar available for openldap? Andreas

3 4

new index on consumer
by Stefan Kania 10 Dec '20

10 Dec '20

Hello If I create a new index on a provider in slapd.conf NOT in cn=config (using mdb). I have to do a slapindex on the provider. When I configure the same index in consumer slapd.conf do I have to do the slapindex here too? Greeting Stefan --

2 1

Symas OpenLDAP for Linux Ubuntu PPA (18 LTS, 20 LTS)
by Quanah Gibson-Mount 09 Dec '20

09 Dec '20

Symas is now producing a PPA for Symas OpenLDAP for Linux on the Ubuntu platform. Packages can be obtained from: <https://launchpad.net/~symas/+archive/ubuntu/sofl/> The PPA build keeps all Ubuntu modifications (such as building nssov, etc). Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Changes to CentOS project
by Quanah Gibson-Mount 09 Dec '20

09 Dec '20

In case people missed it, the CentOS project is changing how it operates, and changing the EOL for CentOS8 from 2029 to the end of 2021: <https://blog.centos.org/2020/12/future-is-centos-stream/> Symas plans to continue to produce packages suitable for CentOS7 and CentOS8 until their respective EOLs, and to continue to provide packages for RHEL7 and RHEL8 until their EOLs. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Reset admin pass
by Клеусов Владимир Сергеевич 09 Dec '20

09 Dec '20

Hi. How do I change the admin password correctly and not break replication ? =) here when setting up replication the password was mentioned dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW olcRootPW: 123 And dn: olcDatabase={0}config,cn=config changetype: modify replace: olcSyncRepl olcSyncRepl: rid=001 provider=ldaps://ldap1.domain.com searchbase="cn=config" bindmethod=simple credentials=123 binddn="cn=admin,cn=config" tls_reqcert=never type=refreshAndPersist retry="30 +" timeout=1 olcSyncRepl: rid=002 provider=ldaps://ldap2.domain.com searchbase="cn=config" bindmethod=simple credentials=123 binddn="cn=admin,cn=config" tls_reqcert=never type=refreshAndPersist retry="30 +" timeout=1 tls_reqcert=never type=refreshAndPersist retry="5 5 300 5" timeout=1 - replace: olcMirrorMode olcMirrorMode: TRUE

3 15

objectclass for organizationIdentifier?
by mark 08 Dec '20

08 Dec '20

Hi all, while creating directory entries in OpenLDAP I am struggling with the attribute organizationIdentifier (OID 2.5.4.97). The main problem: there seems to be no standard objectClass that contains this attribute (i.e. not in X.521). This has already been discussed in this thread from 2017: https://www.openldap.org/lists/openldap-technical/201701/msg00075.html. I would like to avoid creating my own custom auxiliary class when possible. Is anybody aware of (or has created) an existing object class for this attribute? - Mark

1 0

Failing "id uid" test
by armin.vehr＠mmlab.de 06 Dec '20

06 Dec '20

Hi ML! I have set up an OpenLDAP server with TLS/SSL support from the repositories. The platform is Debian 10. I followed this guide: https://kifarunix.com/setup-openldap-server-with-ssl-tls-on-debian-10/ Now I want to use the LDAP users on a CentOS 8 client, so I followed this guide in order to set up the LDAP authentication mechanisms: https://kifarunix.com/configure-sssd-for-openldap-authentication-on-centos-… The current state is that I get the following message returned when I try to check an LDAP user's ID on the client system: [root@myldapclient ~]# id testuser id: `testuser´: no such user Obviously sth. is malconfigured. At least enumerating all LDAP objects works on the client. The command ldapsearch -h myldapserver.mycompany.mytld -x -D "cn=readonlybind,dc=mycompany,dc=mytld" -W -LLL -b "dc=mycompany,dc=mytld" returns all of the LDAP's objects. I'd appreciate hints how to track the issue down. First: What is the default LDAP log on Debian 10 or how can I determine an alternative log, if this is recommended? Thank you! __________ Information from mm-lab IT security __________The message was checked by ESET Mail Security.

2 1

sharing transactions across threads
by James Anderson 04 Dec '20

04 Dec '20

the mdb_env_open documentation includes in its note about NOTLS, that A read-only transaction may span threads if the user synchronizes its use. to which read-only operations would this constraint apply? mdb_cursor_open and mdb_cursor_close look as if they modify transaction state for write transactions only. best regards, from berlin

5 11

Other error (80) when adding olcTLSCipherSuite
by Benjamin Schneider 03 Dec '20

03 Dec '20

Hi all, I'm running version 2.4.49 on Ubuntu 20.04. I've been unable to add the olcTLSCipherSuite configuration attribute. # ldapmodify -H ldapi:// -Y EXTERNAL -f set-ciphersuite.ldif returns: SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "cn=config" ldap_modify: Other (e.g., implementation specific) error (80) set-ciphersuite.ldif contains the following: dn: cn=config changetype: modify add: olcTLSCipherSuite olcTLSCipherSuite: ALL I was able to successfully configure (and confirmed working) TLS by setting the following attributes: olcTLSCACertificateFile: /etc/ssl/certs/mydomain.fullchain.pem olcTLSCertificateFile: /etc/ssl/certs/mydomain.cert.pem olcTLSCertificateKeyFile: /etc/ssl/private/mydomain.privkey.pem and was just looking to limit which ciphers would be offered. I've found several discussions (here, on stackoverflow, etc.) that mention this error, but those discussions concerned these latter TLS attributes (which I had no problem adding) and not the olcTLSCipherSuite attribute. They also pointed to file permissions being the issue for the certificate files, which I've confirmed is not an issue. I would be grateful if anyone could point me in the right direction Ben

2 2

LDAP proxy backend does not drop idle connections
by Tero Saarni 02 Dec '20

02 Dec '20

Hi, I understood from slapd-ldap(5) description of "idle-timeout" that cached connections towards remote LDAP server would be automatically dropped after <time> seconds. Problem: cached connections that are idle do not get dropped. Questions: (1) Is this expected? (2) Are idle connections kept due to limitation in the implementation: when connection is idle, back-ldap does not have a trigger that could be used to drop idle connections? Background: While experimenting with this, it seems that idle timeout is only checked when there is new activity towards the cached connection i.e. connection needs to become active before idle timeout is checked. If the connection just remains idle, nothing will happen. I'm trying to study the timeout handling in back-ldap code, and I believe I found relevant code at the end of ldap_back_getconn() in bind.c. It will eventually trigger unbind and disconnect, but only when new activity happens after the idle period is reached. I did not find other paths that could trigger unbind of cached connection. -- Tero

4 8

HAProxy protocol support?
by Paul B. Henson 01 Dec '20

01 Dec '20

So management is insisting that we migrate our openLDAP systems from on premise into the cloud <sigh>. Specifically, AWS behind one of their load balancers. However, we currently rely upon some level of IP address based access control to distinguish between on-campus and off-campus clients. The Amazon load balancers do client NAT, so the back end servers have no idea who is connecting at the TCP/IP level. They do support the haproxy in band protocol for supplying this information from the load balancer to the server, but that requires specific support from the server to do. I don't see any such support in openldap or any evidence of past discussion regarding it. Is this something that would be considered as a possible feature to be included at some point, or something not desired as part of the code base? Thanks...

8 9

Re: Antw: [EXT] LDAP proxy backend does not drop idle connections
by Ulrich Windl 01 Dec '20

01 Dec '20

>>> Tero Saarni <tero.saarni(a)est.tech> schrieb am 01.12.2020 um 09:20 in Nachricht <HE1P189MB0491BEEEFFF202642C4145A988F40(a)HE1P189MB0491.EURP189.PROD.OUTLOOK.COM>: > Ulrich Windl wrote: >> It may depend on the version, but for us it worked. How did you check that > it doesn't work? > > I have tested by setting up "idassert‑bind" configuration which results in > cached connection. I set idle‑timeout to 5 (seconds). I did packet capture > with Wireshark to see that the connection is still up. OK, I don't know about the allowable range of the timeout and the scale of problem you are having, but we had idle connections that were inactive for days or weeks, so we set the timeout to one day. That worked. Considering that a closed connection may stay around for several seconds, a timeout of 5 seconds seems extremely short to me, however. Regards, Ulrich > > To test I have executed: > > 1. execute search from client > 2. wait for the duration of idle‑timeout to expire > 3. observe from LDAP protocol capture that the connection is still up > > > Secondly I tested: > > 1. execute search from client > 2. wait for the duration of idle‑timeout to expire > 3. execute search from client again > 4. observe that unbind and TCP connection tear down happened immediately > after step 3 > > > I also tested that search before idle timeout extends the timeout: > > 1. execute search from client > 2. execute search from client again before idle‑timeout > 3. observe that nothing happens > 4. execute search after idle‑timeout has passed when measuring the time from > step 2. > 5. observe that unbind and TCP connection tear down happened immediately > after step 4 > > > I also tried to find the function within back‑ldap code that compares the > idle timeout value. This is the only place in the code I found idle timeout > being compared > https://git.openldap.org/openldap/openldap/‑/blob/master/servers/slapd/back… > dap/bind.c#L1133 and it is in function ldap_back_getconn(). I attached gdb > to slapd and breakpoint to the function. Debugger shows that it does not > seem to get called unless there is activity from client to proxy i.e. not > during connection from proxy to remote LDAP remains idle. > > I tested only with recent releases and git master, not with very old > versions since they are bit harder to compile with modern distros. But I > have compared the code from a random historical release. It seems to be the > same as today. > > Quanah also replied "back‑ldap likely needs a task to check for idle > connections" so I'm bit puzzled if this has worked previously. Maybe > ldap_back_getconn() can be called in some other scenario also without having > traffic from client towards the proxy? > > ‑‑ > Tero

2 1

In case ldap_install_tls fails, should we call ldap_unbind_ext?
by Simon Pichugin 23 Nov '20

23 Nov '20

Hello, I have a question regarding libldap function ldap_install_tls(). If it fails, is it the right thing to call ldap_unbind_ext() after that? If we call it, does it mean that ldap_install_tls() made a bind? Or do we call ldap_install_tls() on the connection that is already bound? Sorry if the information is available somewhere, but I missed to find it. The only thing I found is that OpenLDAP server calls ldap_unbind_ext() in case of failure but maybe I miss something... https://git.openldap.org/openldap/openldap/-/blob/master/servers/slapd/back… Thank you, Simon

3 2

Antw: [EXT] Re: HAProxy protocol support?
by Ulrich Windl 20 Nov '20

20 Nov '20

>>> "Dr. Ogg" <ogg(a)sr375.com> schrieb am 18.11.2020 um 17:55 in Nachricht <DM5PR06MB32906E48D22C0F65570D9BD0F0E10(a)DM5PR06MB3290.namprd06.prod.outlook.com> > http://www.haproxy.org/download/1.8/doc/proxy‑protocol.txt > > for reference. > > > From: Howard Chu <hyc(a)symas.com> > Date: Wednesday, November 18, 2020 at 8:51 AM > To: Paul B. Henson <henson(a)acm.org>, openldap‑technical(a)openldap.org > <openldap‑technical(a)openldap.org> > Subject: Re: HAProxy protocol support? > Paul B. Henson wrote: >> So management is insisting that we migrate our openLDAP systems from on > premise into the cloud <sigh>. Specifically, AWS behind one of their load > balancers. >> >> However, we currently rely upon some level of IP address based access > control to distinguish between on‑campus and off‑campus clients. The Amazon > load balancers >> do client NAT, so the back end servers have no idea who is connecting at the > TCP/IP level. >> >> They do support the haproxy in band protocol for supplying this information > from the load balancer to the server, but that requires specific support from > the >> server to do. I don't see any such support in openldap or any evidence of > past discussion regarding it. >> >> Is this something that would be considered as a possible feature to be > included at some point, or something not desired as part of the code base? > > Depends on what that feature actually looks like. Feel free to submit a > proposal > on the ‑devel mailing list, including background info on what HAproxy > protocol > looks like, and what exact behaviors you want it to provide. I wonder: Would it be possible to use a specific named bind for on-campus hosts, and use the name used for binding to controll further access? > > ‑‑ > ‑‑ Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/

2 2

NTLMv2 credentials over ldap
by moore chestnut 19 Nov '20

19 Nov '20

Hello. I have a proxy application acting as a ntlm server, that supports a NTLM handshake between web based clients. If using NTLMv1, sending the NTLM credential blob to an Active Directory over LDAP using openldap client works. openldap client Version. 2.4.32 Basically just taking the ntlm response from the NTLM 3 message from client and sending over LDAP. However using NTLMv2 , the active directory always issues invalid credentials even though the user name and password that the client entered are good. It passes with successful ldap bind with NTLMv1. Can or should this work with ntlmv2? It seems that when EPA and MIC is present from client in the NTLM3, that the ldap exchange does not work. I guess that may be an active directory issue but wanted to check if experts here think it should work. Thanks for your review.

1 0

LMDB alignment
by Alec Matusis 19 Nov '20

19 Nov '20

Our code gets references to 8 or 16 byte structs by casting pointers into LMDB data. 1. In a database with no DUPs and 8 byte (u64) keys, can we expect the corresponding value to have alignment 8? 2. In a database with DUPs and 8 byte (u64) keys, if a DUP value (stored as a key internally) is 16 bytes, does it mean that its alignment is 16? Does the 8 byte key size impact the alignment of its DUPs as it does in 1.?

2 1

how to add group in the slave/consumer node
by 张连生 18 Nov '20

18 Nov '20

Hi， My company maintains an openldap server which stores the information of all the employees. All company internal systems authenticate with it when users login. My department is responsible for software developing/testing and divided into many teams. I want to add the employees of my department to corresponding team in openldap so that I can manage user permission based on teams in jira/confluence/gerrit/gitlab/svn/jenkins and so on. However, I have no permission to add team or group to company openldap server. My plan is to : 1. set up a new openldap server inside my department. 2. synchronize the user data necessary from the company openldap server to my department openldap server. 3. create groups in department openldap server. 4. add users to corresponding group in department openldap server. 5. jira/confluence/gerrit/gitlab/svn/jenkins with authenticate with department openldap server instead of the company one. How to configure openldap to achieve this？I have googled for two days about replication/meta-directory, but still have no idea. BTW, I know Jira have similar functionality and can authenticate for confluence, but Jira can not authenticate for other sofeware such as gerrit/gitlab/svn/jenkins. Any help is appreciated. BRs, Liansheng

2 4

LTB OpenLDAP 2.4.56 (was:OpenLDAP 2.4.56 available)
by Clément OUDOT 16 Nov '20

16 Nov '20

Hello, Debian and RPM packages are now available on LTB repositories.See https://ltb-project.org/download#openldap Clément.

1 0

Connections blocked for some tens of seconds while a single slapd thread running 100%
by Simone Piccardi 11 Nov '20

11 Nov '20

Hi, we got a quite strange behaviour in which a slapd server stops processing connections for some tens of seconds while a single thread is running 100% on a single CPU and all other CPU are almost idle. When the problem arise there is no significant iowait or disk I/O (and no swapping, that's disabled). Context switches just go near zero (from some tens of thousand to some hundreds). Load average is almost always under 2. The server has 32G of RAM and 4 HT processors, is running openldap-2.4.54 in mirror mode (but no delta replication) using the mdb backend. The same behaviour was found also with 2.4.53. OpenLDAP is the only service running on it, apart SSH and some monitoring tools. Database maxsize is 25G around 17G are used. I'm attaching a redacted configuration of the main server (the secondary one is the same, with IDs reverted for mirror mode use) Most of the time it works just fine, processing a up to a few thousand of read query per second while having some tens of write per second. Connections are managed by HA-proxy, sending them to this server by default (used as main node). Many times these stop are short (around 10 second) and we don't lost connections, but when the problem arise and last for enough time, HAproxy switch to the second node, and we got downtimes. Staying with the secondary node we have the same behaviour. The problem manifests itself without periodicity and looking on the number of connection before it we could not see any usage peak. We tried to strace slapd threads during the problem, and they seem blocked on a mutex waiting for the one running at 100% (in a single CPU, user time). I'm attaching a top results during one of these events. From the behaviour I was suspecting (just a wild and uninformated guess) some indexing issue, blocking all access. We tried to change tool-threads to 4 because I found it cited in some example as related to threads used for indexing, but the change has no effect. Re-reading last version of man-page, if I understand it correctly, it's effective only for slapadd etc. So a first question is: there is any other configuration parameter about indexing that I can try? Anyway I'm not sure if there is an effective indexing issue (indexes are quite basic). I was suspecting this because there are lot of writes, and there is no strace activity during the stop. I should look somewhere else? Any suggestion on further checks or configuration changes will be more than appreciated. Regards Simone

5 7

Symas OpenLDAP for Linux 2.4.56-1 released
by Quanah Gibson-Mount 10 Nov '20

10 Nov '20

The latest version of Symas OpenLDAP for Linux, 2.4.56-1, is now available. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

HDB to MDB migration results in higher CPU usage on openldap consumers
by paul.jc＠yahoo.com 09 Nov '20

09 Nov '20

Hello, I have migrated from HDB to MDB backend and I am seeing higher CPU usage on my MDB openldap consumers. Has anyone else seen the same? Testing in my stage environment showed MDB to use less or the same amount of CPU than HDB - but now with real traffic and a large dataset I see sustained high CPU utilization. My production environment has the following specs: 6 consumer servers with 8vCPU x 16G RAM openldap version 2.4.45 Syncrepl enabled (with a single openldap provider server which is also MDB and has no issues and no high cpu). The database has ~230K users. data.mdb is about 1.8G in size. MDB database directives include: olcDbCheckpoint: 102400 10 olcDbNoSync: TRUE The rest are defaults. Indexing includes: olcDbIndex: businessCategory eq olcDbIndex: cn eq,sub olcDbIndex: description eq olcDbIndex: displayName eq,sub olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcDbIndex: gidNumber eq olcDbIndex: givenName eq,sub olcDbIndex: mail eq olcDbIndex: member eq olcDbIndex: memberOf eq olcDbIndex: memberUid eq olcDbIndex: objectClass pres,eq olcDbIndex: sn eq,sub olcDbIndex: uid eq,sub olcDbIndex: uidNumber eq olcDbIndex: uniqueMember eq These consumer servers are used for reads only. The initial sync with the provider is ok but once the consumers are actively handling read requests, CPU jumps to 60% usage on average. Our HDB consumers had half the resources (4vCPU and 8GB RAM) and less than half the CPU usage (average of 25% utilization). I have tested adding other MDB directives (writemap, mapasync, nordahead) but cannot get CPU utilization to come down close to what we see with the HDB backend. I have also load tested in my stage environment and was unable to reproduce (MDB generally utilized the same or less resources than HDB, but never double). There has been no change in the data or traffic between migration. We have also reverted some servers back to HDB and then back to MDB to confirm the high utilization. Has anyone else come across this with MDB and if so, were you able to alleviate CPU utilization? I can provide more details if needed. Any input welcome. Thanks! Paul

4 13

Increasing MDB_MAXKEYSIZE
by Alec Matusis 09 Nov '20

09 Nov '20

We ran into a MDB_BAD_VALSIZE limitation with a value size in a DUP value (which is a key). Can we increase the MDB_MAXKEYSIZE to 100KB or to 1MB without a significant performance penalty?

2 1

Grafana Dashboard for recent OpenLDAP releases
by Quanah Gibson-Mount 05 Nov '20

05 Nov '20

I've created the following Grafana dashboard for recent OpenLDAP releases (2.4.49 or later) that obtains data from the MDB backend database in addition to the normal OpenLDAP stats. May need adjustment for which database the primary DB is (It assumes DB#1) <https://grafana.com/grafana/dashboards/13349> --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

pwdChangedTime Attribute
by Technology Server 05 Nov '20

05 Nov '20

Dears, We want to reproduce a scenario where user's OpenLDAP password is expired. For doing that we need to edit the pwdChangedTime attribute and set its value to a past date-timestamp. This attribute is not editable and we need to edit it manually for our requirement. Can you please let us know how we can edit the value of pwdChangedTime?

2 1

Password Change Report
by Technology Server 05 Nov '20

05 Nov '20

Dears, We will require a list of users under ou=xyz whose passwords are going to expire in next 2 weeks. Can you please let us know how can we pull via linux cli & open 'ldap browser' e.g apache DS.

1 0

Migration of Password Hash from RDBMs
by Thangavel, Parameswaran 04 Nov '20

04 Nov '20

Team, I looking to replace RDBMS with openldap as datastore for one of the product. One blocker we have is handling the password migration. The password is stored in hashed format in RDBMS. However, I am not able to get the password migrated. My goal is to migrate the data from RDBMS to OpenLDAP but without asking the end user to reset or change their password post the migration. Question: 1. Do we have any way to intercept the ldap bind verification and put my own logic? 2. Do we have any way to modify or customize the password hash calculation that is used by opendlap during LDAP bind. 3. Any other suggestion? Thanks Param

2 3

Disable or remove Bind DN syntax check
by Giuseppe 04 Nov '20

04 Nov '20

Hi to all, for my companty I'm triing to setup a LDAP proxy to our Active Direcory implementation, after some time I have found several problems on some critical application that does not support multiple OU anche CN formed by "Surname Name" caused by the bad structure and nomenclature on the AD, but we cant change it. To work around the problem I have used the rwm module to rewrite the client binddn query part to AD format name.surname@domain, but the proxy return: [root@client ~]# ldapsearch -H ldap://192.168.29.134 ��-D "CN=Name.Surname,OU=subou,OU=Users HOUSE,DC=domain,DC=int" -W ldap_bind: Invalid syntax (21) �� additional info: bindDN massage error �� some logs: Nov ��3 21:32:33 proxy slapd[1309]: conn=1001 op=0 do_bind Nov ��3 21:32:33 proxy slapd[1309]: >>> dnPrettyNormal: <CN=Name.Surname,OU=subou,OU=Users HOUSE,DC=domain,DC=int> Nov ��3 21:32:33 proxy slapd[1309]: <<< dnPrettyNormal: <cn=Name.Surname,ou=subou,ou=Users HOUSE,dc=domain,dc=int>, <cn=Name.Surname,ou=subou,ou=users house,dc=domain,dc=int> Nov ��3 21:32:33 proxy slapd[1309]: conn=1001 op=0 BIND dn="cn=Name.Surname,ou=subou,ou=Users HOUSE,dc=domain,dc=int" method=128 Nov ��3 21:32:33 proxy slapd[1309]: do_bind: version=3 dn="cn=Name.Surname,ou=subou,ou=Users HOUSE,dc=domain,dc=int" method=128 Nov ��3 21:32:33 proxy slapd[1309]: daemon: activity on 1 descriptor Nov ��3 21:32:33 proxy slapd[1309]: daemon: activity on: Nov ��3 21:32:33 proxy slapd[1309]: ==> rewrite_context_apply [depth=1] string='cn=Name.Surname,ou=subou,ou=Users HOUSE,dc=domain,dc=int' Nov ��3 21:32:33 proxy slapd[1309]: Nov ��3 21:32:33 proxy slapd[1309]: ==> rewrite_rule_apply rule='^([C,c][N,n]=)([^.]*)\.([^.]*)(,[O,o][U,u][^.]*)(,[O,o][U,u][^.]*)(,[O,o][U,u][^.]*)(,[O,o][U,u][^.]*)(,[O,o][U,u][^.]*)(,[O,o][U,u][^.]*)$' string='cn=Name.Surname,ou=subou,ou=Users HOUSE,dc=domain,dc=int' [1 pass(es)] Nov ��3 21:32:33 proxy slapd[1309]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Nov ��3 21:32:33 proxy slapd[1309]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Nov ��3 21:32:33 proxy slapd[1309]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Nov ��3 21:32:33 proxy slapd[1309]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Nov ��3 21:32:33 proxy slapd[1309]: ==> rewrite_rule_apply rule='^([C,c][N,n]=)([^.]*)\.([^.]*)(,[O,o][U,u][^.]*)(,[O,o][U,u][^.]*)(,[O,o][U,u][^.]*)(,[O,o][U,u][^.]*)(,[O,o][U,u][^.]*)$' string='cn=Name.Surname,ou=subou,ou=Users HOUSE,dc=domain,dc=int' [1 pass(es)] Nov ��3 21:32:33 proxy slapd[1309]: ==> rewrite_rule_apply rule='^([C,c][N,n]=)([^.]*)\.([^.]*)(,[O,o][U,u][^.]*)(,[O,o][U,u][^.]*)(,[O,o][U,u][^.]*)(,[O,o][U,u][^.]*)$' string='cn=Name.Surname,ou=subou,ou=Users HOUSE,dc=domain,dc=int' [1 pass(es)] Nov ��3 21:32:33 proxy slapd[1309]: ==> rewrite_rule_apply rule='^([C,c][N,n]=)([^.]*)\.([^.]*)(,[O,o][U,u][^.]*)(,[O,o][U,u][^.]*)(,[O,o][U,u][^.]*)$' string='cn=Name.Surname,ou=subou,ou=Users HOUSE,dc=domain,dc=int' [1 pass(es)] Nov ��3 21:32:33 proxy slapd[1309]: ==> rewrite_rule_apply rule='^([C,c][N,n]=)([^.]*)\.([^.]*)(,[O,o][U,u][^.]*)(,[O,o][U,u][^.]*)$' string='cn=Name.Surname,ou=subou,ou=Users HOUSE,dc=domain,dc=int' [1 pass(es)] Nov ��3 21:32:33 proxy slapd[1309]: ==> rewrite_context_apply [depth=1] res={0,'Name.Surname(a)domain.int'} Nov ��3 21:32:33 proxy slapd[1309]: [rw] bindDN: "cn=Name.Surname,ou=subou,ou=Users HOUSE,dc=domain,dc=int" -> "Name.Surname(a)domain.int" Nov ��3 21:32:33 proxy slapd[1309]: >>> dnPrettyNormal: <Name.Surname(a)domain.int> Nov ��3 21:32:33 proxy slapd[1309]: send_ldap_result: conn=1001 op=0 p=3 Nov ��3 21:32:33 proxy slapd[1309]: send_ldap_result: err=21 matched="" text="bindDN massage error" Nov ��3 21:32:33 proxy slapd[1309]: send_ldap_response: msgid=1 tag=97 err=21 Nov ��3 21:32:33 proxy slapd[1309]: conn=1001 op=0 RESULT tag=97 err=21 text=bindDN massage error I have downloaded the source code for try to remove or skip this check, but with my few programming skills after a month I haven't find the solution. So there is a way (or a better way) to accomplish this need? Best regards, Giuseppe. Config file of my test env: ### Schema includes ########################################################### #include �� /etc/ldap/schema/corba.schema #include �� /etc/ldap/schema/core.schema #include �� /etc/ldap/schema/cosine.schema #include �� /etc/ldap/schema/duaconf.schema #include �� /etc/ldap/schema/dyngroup.schema #include �� /etc/ldap/schema/inetorgperson.schema #include �� /etc/ldap/schema/java.schema #include �� /etc/ldap/schema/misc.schema #include �� /etc/ldap/schema/nis.schema #include �� /etc/ldap/schema/openldap.schema #include �� /etc/ldap/schema/ppolicy.schema #include �� /etc/ldap/schema/collective.schema #include �� /etc/openldap/schema/ad.schema include �� /etc/openldap/schema/corba.schema include �� /etc/openldap/schema/core.schema include �� /etc/openldap/schema/cosine.schema #include �� /etc/ldap/schema/duaconf.schema #include �� /etc/ldap/schema/dyngroup.schema include �� /etc/openldap/schema/inetorgperson.schema #include �� /etc/ldap/schema/java.schema include �� /etc/openldap/schema/misc.schema include �� /etc/openldap/schema/nis.schema #include �� /etc/ldap/schema/openldap.schema #include �� /etc/ldap/schema/ppolicy.schema #include �� /etc/ldap/schema/collective.schema include �� /etc/openldap/schema/ad.schema # ## Module paths ############################################################## #modulepath �� /usr/lib/ldap/ moduleload �� back_ldap moduleload �� rwm overlay �� rwm rwm-rewriteEngine �� on rwm-rewriteContext �� bindDN rwm-rewriteRule �� "^([C,c][N,n]=)([^.]*)\\.([^.]*)(,[O,o][U,u][^.]*)(,[O,o][U,u][^.]*)$" "$2.$3(a)domain.int" ":@I" #rwm-rewriteRule �� "^([C,c][N,n]=)([^.]*)\\.([^.]*)(,[O,o][U,u][^.]*)(,[O,o][U,u][^.]*)$" "domain\\$2.$3" ":@I" #rwm-rewriteRule �� "^([C,c][N,n]=)([^.]*)\\.([^.]*)(,[O,o][U,u][^.]*)(,[O,o][U,u][^.]*)$" "CN=$3 $2$4$5" ":@I" # Main settings ############################################################### pidfile �� /var/run/openldap/slapd.pid argsfile �� /var/run/openldap/slapd.args allow bind_v2 ### Database definition (Proxy to AD) ######################################### database �� config database �� ldap readonly �� yes protocol-version �� 3 rebind-as-user uri �� "ldap://192.168.29.133:389" suffix �� "dc=domain,dc=int" rootdn �� "CN=Administrator,CN=Users,DC=domain,DC=int" rootpw �� "hidden" idassert-bind bindmethod=simple �� binddn="CN=Administrator,CN=Users,DC=domain,DC=int" �� credentials="hidden" �� mode=none �� flags=non-prescriptive idassert-authzFrom "*" #overlay �� rwm rwm-map �� attribute �� uid �� sAMAccountName rwm-map �� attribute �� mail �� proxyAddresses ### Logging ################################################################### loglevel �� -1

3 2

How does docker deployed ldap realize mailbox login
by HaoDongZ 04 Nov '20

04 Nov '20

Hello: The ldap deployed by my docker can now log in with account and password. How to log in to ldap by email? I deployed tls authentication, how do I log in to ldap by email? My deployment reference document: https://github.com/osixia/docker-openldap#tls -- HaoDongZ Beijing Dongcheng District

2 3

ppolicy issues
by Kresimir Petkovic 03 Nov '20

03 Nov '20

Hi guys, I'm having issues trying to setup multiple databases with different password hash algos. My first db has to have plaintext passwords and I'm using password-hash {CLEARTEXT} overlay ppolicy ppolicy_hash_cleartext and my second one needs to use SHA for password hash. I have it like this in slapd.conf password-hash {SHA} overlay ppolicy ppolicy_hash_cleartext When I insert user in ldap via ldapadd it stores plaintext password for that user in userPassword attribute. Can I have different password-hash directives for each database? Or my ppolicy overlay doesn't work. Thanks in advance. BR, Kreso

2 1

openldap on RHEL 8 - can't get TLS connectivity
by Heinemann, Peter G 03 Nov '20

03 Nov '20

Good Day, Working on moving from RHEL6 to RHEL8. Given the drop in support for openldap in RHEL8 I've installed the symas-openldap distros. Here are the versions in play: cat /etc/redhat-release Red Hat Enterprise Linux release 8.2 (Ootpa) sudo yum list installed | grep openldap openldap.x86_64 2.4.46-9.el8 @rhel-8-for-x86_64-baseos-rpms symas-openldap.x86_64 2.4.55-1.el8 @sofl symas-openldap-clients.x86_64 2.4.55-1.el8 @sofl symas-openldap-servers.x86_64 2.4.55-1.el8 @sofl $ openssl version OpenSSL 1.1.1c FIPS 28 May 2019 I can't get any TLS connections to succeed, even if I try ldapsearch from the local (ldap server) host. The net error is cipher incompatibility; here's the output from a local ldapsearch: ldap_url_parse_ext(ldaps://dev-pnldap1.net.isc.upenn.edu:636) ldap_create ldap_url_parse_ext(ldaps://dev-pnldap1.net.isc.upenn.edu:636/??base) ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP dev-pnldap1.net.isc.upenn.edu:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 130.91.185.254:636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 attempting to connect: connect success TLS trace: SSL_connect:before SSL initialization TLS trace: SSL_connect:SSLv3/TLS write client hello TLS trace: SSL3 alert read:fatal:handshake failure TLS trace: SSL_connect:error in error TLS: can't connect: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure. ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) I had slapd running in foreground for that ldapsearch, here's the output: TLS trace: SSL_accept:before SSL initialization tls_read: want=5, got=5 0000: 16 03 01 01 26 ....& tls_read: want=294, got=294 0000: 01 00 01 22 03 03 cb 02 a0 2f ea 25 ad d7 c9 8e ..."...../.%.... 0010: f0 32 a4 1e a9 46 be af 48 9e e6 23 53 44 d2 f7 .2...F..H..#SD.. 0020: e0 9d 99 82 50 17 20 dd fa 96 00 76 ab ce a7 ec ....P. ....v.... 0030: 2b b9 e6 51 e0 77 78 2d ca 73 4c f4 eb 62 ed 62 +..Q.wx-.sL..b.b 0040: 97 3b d4 ea ea 16 ab 00 48 13 02 13 03 13 01 13 .;......H....... 0050: 04 c0 2c c0 30 cc a9 cc a8 c0 ad c0 2b c0 2f c0 ..,.0.......+./. 0060: ac c0 23 c0 27 c0 0a c0 14 c0 09 c0 13 00 9d c0 ..#.'........... 0070: 9d 00 9c c0 9c 00 3d 00 3c 00 35 00 2f 00 9f cc ......=.<.5./... 0080: aa c0 9f 00 9e c0 9e 00 6b 00 67 00 39 00 33 00 ........k.g.9.3. 0090: ff 01 00 00 91 00 0b 00 04 03 00 01 02 00 0a 00 ................ 00a0: 0c 00 0a 00 1d 00 17 00 1e 00 19 00 18 00 23 00 ..............#. 00b0: 00 00 16 00 00 00 17 00 00 00 0d 00 30 00 2e 04 ............0... 00c0: 03 05 03 06 03 08 07 08 08 08 09 08 0a 08 0b 08 ................ 00d0: 04 08 05 08 06 04 01 05 01 06 01 03 03 02 03 03 ................ 00e0: 01 02 01 03 02 02 02 04 02 05 02 06 02 00 2b 00 ..............+. 00f0: 05 04 03 04 03 03 00 2d 00 02 01 01 00 33 00 26 .......-.....3.& 0100: 00 24 00 1d 00 20 8a 31 32 cf fd 40 46 5d aa b6 .$... .12..@F].. 0110: 4b 31 fb a2 6d 47 92 f9 46 25 02 ce 62 7a cf 0b K1..mG..F%..bz.. 0120: 93 38 00 37 7f 2f .8.7./ TLS trace: SSL_accept:before SSL initialization tls_write: want=7, written=7 0000: 15 03 03 00 02 02 28 ......( TLS trace: SSL3 alert write:fatal:handshake failure TLS trace: SSL_accept:error in error TLS: can't accept: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher. 5fa072c7 connection_read(11): TLS accept failure error=-1 id=1000, closing I've tried various combinations of TLSProtocolMin (3.3, 3.2, and not specifying at all) and the result is the same. I tried specifiying the ciphers currently supported by openssl in TLSCipherSuite, same erros. Running some outside utilities give the same information. nmap: no ciphers returned for the rhel8 system: nmap --script ssl-enum-ciphers -p 636 dev-pnldap1.net.isc.upenn.edu -Pn Starting Nmap 5.51 ( http://nmap.org ) at 2020-11-02 16:25 EST Nmap scan report for dev-pnldap1.net.isc.upenn.edu (130.91.185.254) Host is up (0.0014s latency). PORT STATE SERVICE 636/tcp open ldapssl Nmap done: 1 IP address (1 host up) scanned in 0.85 seconds rhel6 system: $ nmap --script ssl-enum-ciphers -p 636 dev-pnldap2.net.isc.upenn.edu -Pn Starting Nmap 5.51 ( http://nmap.org ) at 2020-11-02 16:25 EST Nmap scan report for dev-pnldap2.net.isc.upenn.edu (130.91.185.136) Host is up (0.0019s latency). PORT STATE SERVICE 636/tcp open ldapssl | ssl-enum-ciphers: | TLSv1.2 | Ciphers (14) | TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA | TLS_DHE_RSA_WITH_AES_128_CBC_SHA | TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 | TLS_DHE_RSA_WITH_AES_256_CBC_SHA | TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA | TLS_RSA_WITH_3DES_EDE_CBC_SHA | TLS_RSA_WITH_AES_128_CBC_SHA | TLS_RSA_WITH_AES_128_CBC_SHA256 | TLS_RSA_WITH_AES_256_CBC_SHA | TLS_RSA_WITH_AES_256_CBC_SHA256 | TLS_RSA_WITH_RC4_128_MD5 | TLS_RSA_WITH_RC4_128_SHA | Compressors (1) |_ uncompressed Nmap done: 1 IP address (1 host up) scanned in 0.30 seconds Thanks in advance for any suggestions or corrections. Peter

2 1

Symas OpenLDAP for Linux 2.4.55-1 released
by Quanah Gibson-Mount 29 Oct '20

29 Oct '20

The latest version of Symas OpenLDAP for Linux, 2.4.55-1, is now available. Additionally, module compilation for lastbind and noopsrch has been fixed so they are now functional. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Chain and ppolicy: what am I missing?
by Larry Rosenman 29 Oct '20

29 Oct '20

Greetings, New poster. I've been banging my head against this wall for 3 days straight. I have an existing LDAP set up with 1 master and 3 replicas. We need to add the policy overlay, and I've got that working. I'm now trying to get the chain overlay and updateref /ppolicy_forward_updates working, I've followed https://www.openldap.org/doc/admin24/overlays.html#Chaining but I'm obviously missing <something>. If I do a modify to one of the replicas, I get a 52 error code. I do NOT see a successful auth (if I'm reading the debug right, which I may not be). This is with 2.4.42 on Ubuntu 16.04. The replica's ARE receiving the updates, and I have the policy working. The last remaining piece is getting the updates to be sent to the master for ppolicy updates (or any update to a replica). I'm obviously missing something very basic here. I'd appreciate any pointers, help, etc. -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 E-Mail: ler(a)lerctr.org US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

2 1

overlay autoca in OpenLDAP 2.5
by Stefan Kania 23 Oct '20

23 Oct '20

Hello, I play around al little bit with the OpenLDAP 2.5alpha. I'm trying the new overlay for the certificates. I start with the configuration with slapd.conf, because it's faster to change ;-). I started with the two lines from the manpage: -------- overlay autoca caKeybits 4096 ------- The first start of the slapd failed with the error-message: --------- Oct 20 20:39:47 ldap25 systemd[1]: slapd-current.service: Control process exited, code=exited, status=1/FAILURE Oct 20 20:39:47 ldap25 systemd[1]: slapd-current.service: Failed with result 'exit-code'. --------- I checked the config, everything was ok, I tried it a second time and then the slapd startet without problem. This happens after neatly every change of the parameters for this overlay. First start failed, second start was ok without any change in the configuration. Now, when I do an ldapsearch I see: --------- dn: dc=example,dc=net objectClass: domain objectClass: dcObject objectClass: autoCA dc: example cACertificate;binary:: MIIFcDCCA1igAwIBAgIJAKh3GIChqUPoMA0GCSqGSIb3DQEBCwUAMC4 ... VYd8XlDNv6d/04FDyEqKH9KAV5RMXiI9GHbQ== --------- Then I did the following changes in my configuration: --------- overlay autoca caKeybits 4096 userClass inetOrgPerson userKeybits 4096 serverClass ipHost serverKeybits 4096 --------- Because it's a TESTSYSTEM my acl are set: --------- access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to attrs=pKCS8PrivateKey by self ssf=128 write access to * by self write by users read by anonymous auth --------- But when I create a user or a server there is no certificate. In the manpage said: --------- Certificates for users and servers are generated on demand using a Search request --------- But I never saw any certificate. As a user I search for my own Object, but I don't see any certificate. Can I (if it works ;-) ) the server-certificate for TLS? Where can I find some more information about autoca. Thanks for any help Stefan

2 4

Symas OpenLDAP for Linux 2.4.54-1 released
by Quanah Gibson-Mount 23 Oct '20

23 Oct '20

The latest version of Symas OpenLDAP for Linux, 2.4.54-1, is now available. There are a few small changes for this build vs previous builds, in that the lastbind and noopsrch overlays have been added. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Modifying 'top' objectClass
by Zahoor Alizai 16 Oct '20

16 Oct '20

Can I modify the 'top' objectClass in openLDAP to incorporate some activedirectory attributes. Existing schemas in '/etc/ldap/slapd.d/cn=config/cn=schema' can be modified using ldapmodify. But i cannot find 'top' objectClass in any of these. To my knowledge, 'top' is part of system schema but can it be modified?

4 3

ldapsearch -Y EXTERNAL not working
by Stefan Kania 15 Oct '20

15 Oct '20

Hello, I just compiled OpenLDAP 2.5alpha on a debian 10 system. I used this howto: https://tylersguides.com/guides/install-openldap-source-debian-stretch/ Slapd is running and I load the following ldif: ----------------- dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /opt/openldap-current/var/run/slapd.args olcPidFile: /opt/openldap-current/var/run/slapd.pid olcTLSCACertificateFile: /etc/ssl/certificates/demoCA/cacert.pem olcTLSCertificateFile: /etc/ssl/certificates/ldap01-cert.pem olcTLSCertificateKeyFile: /etc/ssl/certificates/ldap01-key.pem olcTLSCipherSuite: TLSv1.2:HIGH:!aNULL:!eNULL olcTLSProtocolMin: 3.3 dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /opt/openldap-current/libexec/openldap olcModuleload: back_mdb.la olcModuleload: pw-sha2.la include: file:///opt/openldap-current/etc/openldap/schema/core.ldif include: file:///opt/openldap-current/etc/openldap/schema/cosine.ldif include: file:///opt/openldap-current/etc/openldap/schema/nis.ldif include: file:///opt/openldap-current/etc/openldap/schema/inetorgperson.ldif dn: olcDatabase=frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: frontend olcPasswordHash: {SSHA512} olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none dn: olcDatabase=config,cn=config objectClass: olcDatabaseConfig olcDatabase: config olcRootDN: cn=config olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none ----------------- When I try to do a ldapsearch with -Y EXTERNAL I get the following error: ----------------- root@lda25:~# ldapsearch -Y EXTERNAL -H ldaps://ldap25.example.net -b cn=config SASL/EXTERNAL authentication started ldap_sasl_interactive_bind: Unknown authentication method (-6) additional info: SASL(-4): no mechanism available: ----------------- Ldapsearch -ZZ is working: ----------------- root@lda25:~# ldapsearch -x -ZZ -H ldap://ldap25.example.net -b cn=config -LLL No such object (32) root@lda25:~# ldapsearch -x -H ldaps://ldap25.example.net -b cn=config -LLL No such object (32) ----------------- So ldaps and ldap+tls is working. Did I miss something during "configure". I would like to help testing version 2.5. Stefan

2 2

OpenLDAP 2.5.0 ALPHA released
by Quanah Gibson-Mount 15 Oct '20

15 Oct '20

Hello -technical, The first alpha release for the OpenLDAP 2.5 series released today, and the source can be obtained from the download page: <https://www.openldap.org/software/download/> The OpenLDAP 2.5 series contains numerous bug fixes and enhancements. Note that some features listed in the ANNOUNCEMENT file in the source tarball are not yet available (I.e., the load balancer). A list of issues marked complete for this alpha can be found in Bugzilla: <https://bugs.openldap.org/buglist.cgi?bug_status=VERIFIED&list_id=858&produ…> Any testing in dev/qa/test environments that people can engage in with this alpha would be extremely helpful. I will be working on making binary builds available to help with testing in the near future. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 2

Re: OpenLDAP 2.5.0 ALPHA released
by Dave Macias 15 Oct '20

15 Oct '20

Sorry for the unnecessary email but my jaw literally dropped... Look forward to the binary builds for testing Stay safe everyone! -Dave On Wed, Oct 14, 2020 at 6:15 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > Hello -technical, > > The first alpha release for the OpenLDAP 2.5 series released today, and > the > source can be obtained from the download page: > > <https://www.openldap.org/software/download/> > > The OpenLDAP 2.5 series contains numerous bug fixes and enhancements. > Note > that some features listed in the ANNOUNCEMENT file in the source tarball > are not yet available (I.e., the load balancer). > > A list of issues marked complete for this alpha can be found in Bugzilla: > > < > https://bugs.openldap.org/buglist.cgi?bug_status=VERIFIED&list_id=858&produ… > > > > Any testing in dev/qa/test environments that people can engage in with > this > alpha would be extremely helpful. I will be working on making binary > builds available to help with testing in the near future. > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

RE24 testing call #1 (OpenLDAP 2.4.54)
by Quanah Gibson-Mount 14 Oct '20

14 Oct '20

This is the first testing call for OpenLDAP 2.4.54. Depending on the results, this may be the only testing call. Generally, get the code for RE24: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_4/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.4.54 Engineering Fixed slapd delta-syncrepl to ignore delete ops on deleted entry (ITS#9342) Fixed slapd delta-syncrepl to be fully serialized (ITS#9330) Fixed slapd delta-syncrepl MOD on zero-length context entry (ITS#9352) Fixed slapd sessionlog to use a TAVL tree (ITS#8486) Fixed slapd syncrepl to be fully serialized (ITS#8102) Fixed slapd syncrepl to call check_syncprov on fresh consumer (ITS#9345) Fixed slapd syncrepl to propagate errors from overlay_entry_get_ov (ITS#9355) Fixed slapd syncrepl to not create empty ADD ops (ITS#9359) Fixed slapd syncrepl replace usage on single valued attrs (ITS#9295) Fixed slapd-monitor fix monitor_back_register_database for empty suffix DB (ITS#9353) Fixed slapo-accesslog normalizer for reqStart (ITS#9358) Fixed slapo-syncprov contextCSN generation with empty suffix (ITS#9015) Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

7 20

smbk5pwd sambaPwdLastSet
by corey＠electrickite.org 12 Oct '20

12 Oct '20

Hello, I have run into an issue with the smbk5pwd overlay in slapd 2.4.49 on FreeBSD and I'm hoping someone can point me in the right direction. The majority of the overlay is functioning correctly - when a user updates their password using an exop the sambaLMPassword and sambaNTPassword attributes are updated along with userPassword. However, the sambaPwdLastSet attribute does not update correctly. After an exop password change the value of sambaPwdLastSet is set to 0. It does not seem to matter whether this attribute is added or updated, it is always set to zero after password change. This is honestly not a huge issue in my environment, but some applications treat a sambaPwdLastSet of zero as an indication that the user must change their password. Below is my smbk5pwd config: dn: olcOverlay={5}smbk5pwd objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcSmbK5PwdConfig objectClass: top olcOverlay: {5}smbk5pwd olcSmbK5PwdEnable: samba olcSmbK5PwdMustChange: 0 -- Corey Hinshaw

1 0

Does openldap support authPassword?
by Siddharth Jain 11 Oct '20

11 Oct '20

If yes, where can I find documentation on how to use/enable it? https://tools.ietf.org/html/rfc3112 The userPassword attribute type [RFC2256<https://tools.ietf.org/html/rfc2256>] is intended to be used to support the LDAP [RFC2251<https://tools.ietf.org/html/rfc2251>] "simple" bind operation. However, values of userPassword must be clear text passwords. It is often desirable to store values derived from the user's password(s) instead of actual passwords. The authPassword attribute type is intended to be used to store information used to implement simple password based authentication. RFC 3112 - LDAP Authentication Password Schema<https://tools.ietf.org/html/rfc3112> RFC 3112 LDAP Authentication Password Schema May 2001 hash algorithm/implementation is flawed), the hashing of passwords is intended to be as an additional layer of protection. It is RECOMMENDED that hashed values be protected as if they were clear text passwords. This attribute may be used in conjunction with server side password generation mechanisms (such as the LDAP Password Modify ... tools.ietf.org

2 1

running slapd under valgrind
by Michael Ströder 10 Oct '20

10 Oct '20

HI! An Æ-DIR installation with self-compiled OpenLDAP 2.4.53 on Debian (now buster) has memory leak issues on the Æ-DIR providers. The read-only consumers do not have this issue. The provider config is more complex with more overlays. slapd is automatically restarted (by monit) when memory consumption reaches 80%. Thus monitoring clearly shows a frequent saw tooth pattern. I'm experimenting with valgrind to track down the issue: valgrind --leak-check=full --show-leak-kinds=all --track-origins=yes --verbose --log-file=valgrind-out.txt -- /opt/openldap-ms/libexec/slapd [...] Does that make sense or are some other command-line options needed? Ciao, Michael.

2 5

Ubuntu ldap client using DNS SRV
by thiago.conrado＠ez-masternodes.com 08 Oct '20

08 Oct '20

Hello everyone, just to share the trick of how to configure openLDAP in Ubuntu. we did config the domain DNS SRV records and ldapsearch -x -LLL -H ldap:///dc%3Dmy-domain%2Cdc%3Dcom works fine... dig shall also return the target server and port with the command "dig SRV _ldap._tcp.my-domain.com." the confusing part is: there are 2 ldap.conf files; a) at /etc/ldap.conf: this one will control the how Ubuntu check user id, feeding PAM via nss_ldap; just keep it with no URI or commented URI entries and DNS SRV will work as expected (DN must be in place); it is possible to test it using the command "id <user>"; journalctl -f and tcpdump port 389 are useful for troubleshoting; b) at /etc/lpad/ldap.conf: it is the param source for tools as ldapsearch; we were not able to make it work without declaring URI, hence, we just pointed to one LDAP server, but you can list it all; another option is to do command aliases as in http://www.rjsystems.nl/en/2100-dns-discovery-openldap.php; a proper configuration should list all the users with ldapsearch -x -LLL; anyway, doing a very small contribution to this great project, as it took us 4 hours to get it going, and we found old mentions that openLDAP do not do resolve SRV records (which was the case in the past), as also, there are some client implementations that do resolve and some that don't. LDAP is very powerful to escalate servers/virtual machines in which credentials sync are required best regards all

1 0

TLS: can't accept: No certificate was found..
by kevhilton＠gmail.com 06 Oct '20

06 Oct '20

Hi - I'm using osixia/openldap docker container. I've created self signed client and server certs. I'm receiving the following error when trying to perform ldapsearch from the Arch linux docker host. Here is a summary of the error: # ldapsearch -x -d1 -b 'dc=ldap,dc=gohilton,dc=com' -D "cn=admin,dc=ldap,dc=gohilton,dc=com" -H ldaps://127.0.0.1:636 -W -LLL d ldap_url_parse_ext(ldaps://127.0.0.1:636) ldap_create ldap_url_parse_ext(ldaps://127.0.0.1:636/??base) Enter LDAP Password: ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 127.0.0.1:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 127.0.0.1:636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 attempting to connect: connect success TLS trace: SSL_connect:before SSL initialization TLS trace: SSL_connect:SSLv3/TLS write client hello TLS trace: SSL_connect:SSLv3/TLS write client hello TLS trace: SSL_connect:SSLv3/TLS read server hello TLS certificate verification: depth: 0, err: 0, subject: /C=US/ST=IL/L=CH/O=domain.com/CN=openldap/emailAddress=user(a)domain.com, issuer: /C=US/ST=IL/L=CH/O=domain.com/CN=Docker OpenLDAP CA/emailAddress=user(a)domain.com TLS trace: SSL_connect:SSLv3/TLS read server certificate TLS trace: SSL_connect:SSLv3/TLS read server key exchange TLS trace: SSL_connect:SSLv3/TLS read server certificate request TLS trace: SSL_connect:SSLv3/TLS read server done TLS trace: SSL_connect:SSLv3/TLS write client certificate TLS trace: SSL_connect:SSLv3/TLS write client key exchange TLS trace: SSL_connect:SSLv3/TLS write change cipher spec TLS trace: SSL_connect:SSLv3/TLS write finished TLS trace: SSL_connect:error in SSLv3/TLS write finished TLS: can't connect: . ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) The server logs the error as the following: f7a7260 conn=1007 fd=12 ACCEPT from IP=172.18.0.1:34350 (IP=0.0.0.0:636) TLS: can't accept: No certificate was found.. 5f7a7260 conn=1007 fd=12 closed (TLS negotiation failure) This error only occurs if on the server I use the following server setting: LDAP_TLS_VERIFY_CLIENT=try Is this possibly a permissions issue? I've verified the chain of trust for client certificate upon creation. Both client and server certificates were signed with same user created CA.

3 5

TLS: during handshake: Peer certificate is not trusted: kSecTrustResultRecoverableTrustFailure
by Siddharth Jain 06 Oct '20

06 Oct '20

(I mistakenly posted this at openldap-its earlier. apologies if anyone saw it there) Hello, We have a LDAP server running with TLS enabled and verified we can connect to it from openssl s_client. This works: $ openssl s_client -connect ldap.foo.com:636 -cert client_tls_cert.pem -key client_tls_key.pem -state -nbio -CAfile ca_chain.pem -showcerts But ldapsearch throws an error: $ ldapsearch -d 1 -x -H ldaps://ldap.foo.com:636 ... -ZZ TLS: during handshake: peer cert is valid, or was ignored if verification disabled (-9841) TLS: during handshake: Peer certificate is not trusted: kSecTrustResultRecoverableTrustFailure We followed the instructions given at https://www.openldap.org/doc/admin24/tls.html#Client%20Configuration. We edited /etc/openldap/ldap.conf like so: TLS_REQCERT demand TLS_CACERT ca_chain.pem TLS_CACERTDIR /path/to/ca/cert TLS_CERT client_tls_cert.pem TLS_KEY client_tls_key.pem The ca_chain.pem file is placed under /path/to/ca/cert. We are running ldapsearch on a Mac. Can anyone help us? Sid PS: we do see following on server: TLS trace: SSL_accept:before SSL initialization TLS trace: SSL_accept:before SSL initialization TLS trace: SSL_accept:SSLv3/TLS read client hello TLS trace: SSL_accept:SSLv3/TLS write server hello TLS trace: SSL_accept:SSLv3/TLS write certificate TLS trace: SSL_accept:SSLv3/TLS write key exchange TLS trace: SSL_accept:SSLv3/TLS write certificate request TLS trace: SSL_accept:SSLv3/TLS write server done

5 9

ACL not behaving as I would expect
by Scott Classen 02 Oct '20

02 Oct '20

Hello, I’m having trouble understanding why I can’t get a service account to reset a userPassword attribute. ACLs are: {0}to attrs=userPassword by self write by anonymous auth by * none {1}to * by self write by users read by dn.base="uid=pwreset,dc=example,dc=com" write by * none But when the password reset utility attempts to modify the password I see the following 50 error, indicating that the ACL is somehow preventing the pwreset account from modifying userPassword Oct 1 14:53:00 bl1231 slapd[10782]: conn=1036 fd=22 ACCEPT from IP=192.168.1.104:52888 (IP=0.0.0.0:389) Oct 1 14:53:00 bl1231 slapd[10782]: conn=1036 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Oct 1 14:53:00 bl1231 slapd[10782]: conn=1036 op=0 STARTTLS Oct 1 14:53:00 bl1231 slapd[10782]: conn=1036 op=0 RESULT oid= err=0 text= Oct 1 14:53:00 bl1231 slapd[10782]: conn=1036 fd=22 TLS established tls_ssf=256 ssf=256 Oct 1 14:53:00 bl1231 slapd[10782]: conn=1036 op=1 BIND dn="uid=pwreset,dc=example,dc=com" method=128 Oct 1 14:53:00 bl1231 slapd[10782]: conn=1036 op=1 BIND dn="uid=pwreset,dc=example,dc=com" mech=SIMPLE ssf=0 Oct 1 14:53:00 bl1231 slapd[10782]: conn=1036 op=1 RESULT tag=97 err=0 text= Oct 1 14:53:00 bl1231 slapd[10782]: conn=1036 op=2 SRCH base="dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=username))" Oct 1 14:53:00 bl1231 slapd[10782]: conn=1036 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= Oct 1 14:53:00 bl1231 slapd[10782]: conn=1036 op=3 MOD dn="uid=username,ou=People,dc=example,dc=com" Oct 1 14:53:00 bl1231 slapd[10782]: conn=1036 op=3 MOD attr=userPassword Oct 1 14:53:00 bl1231 slapd[10782]: conn=1036 op=3 RESULT tag=103 err=50 text= Oct 1 14:53:00 bl1231 slapd[10782]: conn=1036 op=4 UNBIND Oct 1 14:53:00 bl1231 slapd[10782]: conn=1036 fd=22 closed I’ve also tried with this ACL combination: {0}to attrs=userPassword by self write by anonymous auth by dn.base="uid=pwreset,dc=example,dc=com" write by * none {1}to * by self write by users read by * none Any advice would be greatly appreciated. Scott

3 7

Re: RE24 testing call #1 (OpenLDAP 2.4.54)
by Nick Folino 02 Oct '20

02 Oct '20

No problems noted on Fedora 32. On Thu, Oct 1, 2020 at 12:19 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > This is the first testing call for OpenLDAP 2.4.54. Depending on the > results, this may be the only testing call. > > Generally, get the code for RE24: > > < > https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_4/o… > > > > Extract, configure, and build. > > Execute the test suite (via make test) after it is built. Optionally, cd > tests && make its to run through the regression suite. > > Thanks! > > OpenLDAP 2.4.54 Engineering > Fixed slapd delta-syncrepl to ignore delete ops on deleted entry > (ITS#9342) > Fixed slapd delta-syncrepl to be fully serialized (ITS#9330) > Fixed slapd delta-syncrepl MOD on zero-length context entry (ITS#9352) > Fixed slapd sessionlog to use a TAVL tree (ITS#8486) > Fixed slapd syncrepl to be fully serialized (ITS#8102) > Fixed slapd syncrepl to call check_syncprov on fresh consumer > (ITS#9345) > Fixed slapd syncrepl to propagate errors from overlay_entry_get_ov > (ITS#9355) > Fixed slapd syncrepl to not create empty ADD ops (ITS#9359) > Fixed slapd syncrepl replace usage on single valued attrs (ITS#9295) > Fixed slapd-monitor fix monitor_back_register_database for empty > suffix > DB (ITS#9353) > Fixed slapo-accesslog normalizer for reqStart (ITS#9358) > Fixed slapo-syncprov contextCSN generation with empty suffix (ITS#9015) > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Re: RE24 testing call #1 (OpenLDAP 2.4.54)
by Nick Folino 01 Oct '20

01 Oct '20

oops. Yes I did. Sorry. Nick On Thu, Oct 1, 2020 at 1:27 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Thursday, October 1, 2020 2:21 PM -0400 Nick Folino <nick(a)folino.us> > wrote: > > > > > --enable-monitor is missing from configure > > > > > > configure: WARNING: unrecognized options: --enable-monitor > > It appears you grabbed openldap trunk and not the RE24 branch. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Re: RE24 testing call #1 (OpenLDAP 2.4.54)
by Nick Folino 01 Oct '20

01 Oct '20

--enable-monitor is missing from configure configure: WARNING: unrecognized options: --enable-monitor Nick On Thu, Oct 1, 2020 at 12:19 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > This is the first testing call for OpenLDAP 2.4.54. Depending on the > results, this may be the only testing call. > > Generally, get the code for RE24: > > < > https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_4/o… > > > > Extract, configure, and build. > > Execute the test suite (via make test) after it is built. Optionally, cd > tests && make its to run through the regression suite. > > Thanks! > > OpenLDAP 2.4.54 Engineering > Fixed slapd delta-syncrepl to ignore delete ops on deleted entry > (ITS#9342) > Fixed slapd delta-syncrepl to be fully serialized (ITS#9330) > Fixed slapd delta-syncrepl MOD on zero-length context entry (ITS#9352) > Fixed slapd sessionlog to use a TAVL tree (ITS#8486) > Fixed slapd syncrepl to be fully serialized (ITS#8102) > Fixed slapd syncrepl to call check_syncprov on fresh consumer > (ITS#9345) > Fixed slapd syncrepl to propagate errors from overlay_entry_get_ov > (ITS#9355) > Fixed slapd syncrepl to not create empty ADD ops (ITS#9359) > Fixed slapd syncrepl replace usage on single valued attrs (ITS#9295) > Fixed slapd-monitor fix monitor_back_register_database for empty > suffix > DB (ITS#9353) > Fixed slapo-accesslog normalizer for reqStart (ITS#9358) > Fixed slapo-syncprov contextCSN generation with empty suffix (ITS#9015) > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

ldap_start_tls: Connect error - self signed certificate in certificate chain
by paul.jc＠yahoo.com 01 Oct '20

01 Oct '20

Hello, I have recently upgraded from openldap 2.4.45 to 2.5.53. I are running into one issue when running ldapsearch wth StartTLS locally on the openldap servers. I get the following error whereas I did not prior to upgrade. Any input/suggestions welcome. $ ldapsearch -ZZ -LLL -H ldap://<uri> -x -D "cn=admin, dc=<test.dc,dc=com" -b "dc=test,dc=com" -w ${pw} ldap_start_tls: Connect error (-11) additional info: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed (self signed certificate in certificate chain) Here is the debug: -------------- TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 3, err: 19, subject: /C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority, issuer: /C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority TLS certificate verification: Error, self signed certificate in certificate chain TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in error TLS trace: SSL_connect:error in error TLS: can't connect: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed (self signed certificate in certificate chain). ldap_err2string ldap_start_tls: Connect error (-11) additional info: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed (self signed certificate in certificate chain) -------------- This does not happen with the same ldapsearch done remotely - TLS works just fine with remote ldapsearch queries. Running ldapsearch without StartTLS locally on the server works just fine as well. Prior to this upgrade, we had built openldap with MozNSS (--with-tls=moznss) but now are using the recommended openssl. With our earlier version, running ldapsearch with StartTLS locally on the openldap servers worked without issue. Our certs are not self signed but it appears tls with ldapsearch is seeing the CA cert from our CA as self signed when running locally on the server. Is this even a problem since remote connectivity with TLS works fine? Since we were running moznss prior, I am not sure what the expected behavior is now but it seems that it should work the same as before. A few more details: ------------------ -Servers are CentOS Linux release 7.5 -We are running Openldap version: OpenSSL 1.0.2k-fips 26 Jan 2017 -We are using the same certs (no changes to the certs as part of the upgrade) -Here is partial output from openssl s_client -connect <hostname-here>:636 (same result with openssl s_client -connect <hostname-here>:389 -starttls ldap): This shows return code of 0 (ok): -------------- New, TLSv1/SSLv3, Cipher is AES256-GCM-SHA384 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Verify return code: 0 (ok) -------------- -Ran openssl s_client -verify 3 -connect localhost:636 (and with hostname as well) and openssl s_client -showcerts -connect localhost:636. Both return code 0 (ok): Verify return code: 0 (ok) -Checked the certs: openssl verify -verbose -x509_strict -CAfile ca.crt slapd.crt slapd.crt: OK -Here is our cert config: olcTLSCACertificateFile: /etc/openldap/certs/ca.crt olcTLSCertificateFile: /etc/openldap/certs/slapd.crt olcTLSCertificateKeyFile: /etc/openldap/certs/slapd.key For reference, here is the debug output when running the same ldapsearch command locally on the server on our previous version (2.4.45 with moznss) and the same cert is validated. -------------- TLS: certdb config: configDir='/etc/openldap/certs' tokenDescription='ldap(0)' certPrefix='' keyPrefix='' flags=readOnly TLS: using moznss security dir /etc/openldap/certs prefix . TLS: certificate [CN=*<test-domain-here>,OU=Domain Control Validated] is valid TLS certificate verification: subject: CN=*<test-domain-here>,OU=Domain Control Validated, issuer: CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O="GoDaddy.com, Inc.",L=Scottsdale,ST=Arizona,C=US, cipher: AES-256-GCM, security level: high, secret key bits: 256, total key bits: 256, cache hits: 0, cache misses: 0, cache not reusable: 0 ldap_sasl_bind -------------- Any suggestions are appreciated. Thanks. Paul

2 3

When will OpenLDAP 2.5 be released officially?
by junc76＠gmail.com 30 Sep '20

30 Sep '20

Out product is planned to support the ldap channel binding required by MS (ADV190023). It seems that the feature has been implemented. https://bugs.openldap.org/show_bug.cgi?id=9189. From the isse description above, the target milestone is 2.5.0. My question is when will the version 2.5.0 be released? Thank you very much.

2 1

What does "slapcat: error writing output" means?
by Dario García Díaz-Miguel 30 Sep '20

30 Sep '20

Hello everyone, I couldn't find an answer or explanation about this error, so I hope somebody could help me over here. I use slapcat with head, grep and awk to retrieve some information and store it into a variable for a shell/bash script. Whenever I use slapcat, the output prompts the following error: - slapcat: error writing output. However, the information looked for is correctly retrieved. What's the reason behind this message? Is there a way to address it or at least, ignore it and hiding it? I can't just redirect that output to /dev/null. Version: Openldap2-2.4.41-18.43.1 Suse 12 SP3 Thank you so much. Kind Regards. Dario Garcia Díaz-Miguel GGCS-SES Unit GGCS SKMF Infrastructure Division GMV C\ de Isaac Newton, 11 28760, Tres Cantos, Madrid España +34 918 07 21 00 +34 918 07 21 99 www.gmv.com P Please consider the environment before printing this e-mail.

2 1

Issues with resetting user password
by CLARKE, ED C 29 Sep '20

29 Sep '20

Hello, I am new to this arena, I have a Open LDAP installed on my Linux server RHEL 7.8. I am not able to reset user passwords, I have checked the systemctl status slapd.service And it is active & running. Below is an example of the resetpw.ldif: $ cat ResetPW.ldif # dn: uid=foxdiv,ou=People,dc=att,dc=com changetype: modify replace: pwdReset pwdReset: TRUE - replace: userPassword userPassword: xxxxxxxxxxxx Any help would be appreciated, also any help on client side commands to test communications. Thanks, Ed Ed Clarke Senior Software Engineer Operations Transformation, Real-time Automation & Predictive Insights<http://mysolutions.dev.att.com/GNFO_Solutions/index.jsp> "RAPID" Certified Quality Eng. - ISO 9000/1 Six Sigma - Yellow Belt AT&T Veterans AT&T "ATO" 1010 Pine ST. Shared, St. Louis, MO. 63101 m 636.639.0713 | o 314.335.3158 | ec4397(a)att.com<mailto:ec4397@att.com>

4 19

delta-syncrepl "got search entry without Sync State control"
by Stefan Kania 29 Sep '20

29 Sep '20

I try to set up a delta-syncrepl configured via slapd.d. Building the configuration with Ansilbe. I got the following errormessages on my two consumers: ---------------- Sep 08 19:45:49 ldapslave-01 slapd[3198]: do_syncrep2: rid=001 got search entry without Sync State control (reqStart=20200908174203.000008Z,cn=accesslog) Sep 08 19:45:49 ldapslave-01 slapd[3198]: do_syncrepl: rid=001 rc -1 retrying (4 retries left) Sep 08 19:45:54 ldapslave-01 slapd[3198]: do_syncrep2: rid=001 got search entry without Sync State control (reqStart=20200908174203.000008Z,cn=accesslog) Sep 08 19:45:54 ldapslave-01 slapd[3198]: do_syncrepl: rid=001 rc -1 retrying (3 retries left) Sep 08 19:45:59 ldapslave-01 slapd[3198]: do_syncrep2: rid=001 got search entry without Sync State control (reqStart=20200908174203.000008Z,cn=accesslog) Sep 08 19:45:59 ldapslave-01 slapd[3198]: do_syncrepl: rid=001 rc -1 retrying (2 retries left) Sep 08 19:46:04 ldapslave-01 slapd[3198]: do_syncrep2: rid=001 got search entry without Sync State control (reqStart=20200908174203.000008Z,cn=accesslog) Sep 08 19:46:04 ldapslave-01 slapd[3198]: do_syncrepl: rid=001 rc -1 retrying (1 retries left) Sep 08 19:46:09 ldapslave-01 slapd[3198]: do_syncrep2: rid=001 got search entry without Sync State control (reqStart=20200908174203.000008Z,cn=accesslog) Sep 08 19:46:09 ldapslave-01 slapd[3198]: do_syncrepl: rid=001 rc -1 retrying Sep 08 19:46:14 ldapslave-01 slapd[3198]: do_syncrep2: rid=001 got search entry without Sync State control (reqStart=20200908174203.000008Z,cn=accesslog) Sep 08 19:46:14 ldapslave-01 slapd[3198]: do_syncrepl: rid=001 rc -1 retrying ---------------- Here is my configuration of the provider: ------------- # config dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcLogLevel: none olcLogLevel: sync olcLogLevel: stats olcPidFile: /var/run/slapd/slapd.pid olcTLSCACertificateFile: /etc/ssl/certificates/cacert.pem olcTLSCertificateFile: /etc/ssl/certificates/ldapmaster-cert.pem olcTLSCertificateKeyFile: /etc/ssl/certificates/ldapmaster-key.pem olcToolThreads: 1 # module{0}, config dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_mdb olcModuleLoad: {1}syncprov.la olcModuleLoad: {2}accesslog.la . . . # {0}mdb, config dn: olcBackend={0}mdb,cn=config objectClass: olcBackendConfig olcBackend: {0}mdb # {-1}frontend, config dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=exte rnal,cn=auth manage by * break olcAccess: {1}to dn.exact="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read olcSizeLimit: 500 # {0}config, config dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=exte rnal,cn=auth manage by * break olcAccess: {1}to dn.exact="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read olcRootDN: cn=admin,cn=config olcRootPW: {SSHA}VKs74I0HQj84sDa2f8Ie3fwYdEL/BVtb # {1}mdb, config dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=example,dc=net olcAccess: {0} to * by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=e xternal,cn=auth write by dn.exact=cn=ldap-admin,ou=users,dc=example,dc=net wr ite by dn.exact=cn=repl-user,ou=users,dc=example,dc=net read by * break olcAccess: {1} to attrs=userPassword by anonymous auth by self write by * none olcAccess: {2} to attrs=shadowLastChange by self write by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=example,dc=net olcRootPW: {SSHA}psW8QuHfZE1qFpyXTE8r4RGdzzonln6a olcDbCheckpoint: 512 30 olcDbIndex: objectClass eq olcDbIndex: cn,uid eq olcDbIndex: uidNumber,gidNumber eq olcDbIndex: member,memberUid eq olcDbIndex: entryCSN,entryUUID eq olcDbMaxSize: 1073741824 # {0}syncprov, {1}mdb, config dn: olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpCheckpoint: 100 10 olcSpSessionlog: 300 # {2}mdb, config dn: olcDatabase={2}mdb,cn=config objectClass: olcMdbConfig objectClass: olcDatabaseConfig olcDatabase: mdb olcDbDirectory: /var/lib/ldap/accesslog olcSuffix: cn=accesslog olcAccess: {0} to dn.sub=cn=accesslog by dn.exact=cn=repl-user,ou=users,dc=exa mple,dc=net read by dn.exact=cn=ldap-admin,ou=users,dc=example,dc=net read olcDbIndex: reqStart,reqEnd,reqMod,reqResult eq # {0}accesslog, {2}mdb, config dn: olcOverlay={0}accesslog,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogPurge: 01+00:00 00+04:00 olcAccessLogSuccess: TRUE ------------- As you can see, the syncrepl and accesslog overlays are configured. The database files are pressend and filepermission is ok. Here now the configuration of the consumer ------------- # config dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcLogLevel: none olcLogLevel: sync olcLogLevel: stats olcPidFile: /var/run/slapd/slapd.pid olcTLSCACertificateFile: /etc/ssl/certificates/cacert.pem olcTLSCertificateFile: /etc/ssl/certificates/ldapslave-01-cert.pem olcTLSCertificateKeyFile: /etc/ssl/certificates/ldapslave-01-key.pem olcToolThreads: 1 # module{0}, config dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_md . . . # {0}mdb, config dn: olcBackend={0}mdb,cn=config objectClass: olcBackendConfig olcBackend: {0}mdb # {-1}frontend, config dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=exte rnal,cn=auth manage by * break olcAccess: {1}to dn.exact="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read olcSizeLimit: 500 # {0}config, config dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=exte rnal,cn=auth manage by * break olcAccess: {1}to dn.exact="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read olcRootDN: cn=admin,cn=config olcRootPW: {SSHA}VKs74I0HQj84sDa2f8Ie3fwYdEL/BVtb # {1}mdb, config dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=example,dc=net olcAccess: {0} to * by dn.exact=gidNumber=1111+uidNumber=1111,cn=peercred,cn=e xternal,cn=auth write by dn.exact=cn=ldap-admin,ou=users,dc=example,dc=net wr ite by dn.exact=cn=repl-user,ou=users,dc=example,dc=net read by * break olcAccess: {1} to attrs=userPassword by anonymous auth by self write by * none olcAccess: {2} to attrs=shadowLastChange by self write by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=example,dc=net olcRootPW: {SSHA}psW8QuHfZE1qFpyXTE8r4RGdzzonln6a olcSyncrepl: {0}rid=1 provider=ldaps://ldapmaster.example.net type=refreshAndP ersist retry="5 5 300 +" filter="(ObjectClass=*)" scope=sub bindmethod=simple searchbase="dc=example,dc=net" binddn="cn=repl-user,ou=users,dc=example,dc=n et" credentials=geheim syncdata=accesslog logbase="cn=accesslog" logfilter="( &(objectClass=auditWriteObject)(reqResult=0)) olcUpdateRef: ldaps://ldapmaster.example.net olcDbCheckpoint: 512 30 olcDbIndex: objectClass eq olcDbIndex: cn,uid eq olcDbIndex: uidNumber,gidNumber eq olcDbIndex: member,memberUid eq olcDbIndex: entryCSN,entryUUID eq olcDbMaxSize: 1073741824 ------------- I can access the accesslog-DB with ldapsearch as repl-user: ----------------- root@ldapslave-01:~# ldapsearch -x -D cn=repl-user,ou=users,dc=example,dc=net -w geheim -b cn=accesslog -H ldaps://ldapmaster.example.net -LLL dn: cn=accesslog objectClass: auditContainer cn: accesslog dn: reqStart=20200908174203.000008Z,cn=accesslog objectClass: auditAdd reqStart: 20200908174203.000008Z reqEnd: 20200908174203.000011Z reqType: add reqSession: 18446744073709551615 reqAuthzID: cn=accesslog reqDN: cn=accesslog reqResult: 0 reqMod: objectClass:+ auditContainer reqMod: cn:+ accesslog reqMod: structuralObjectClass:+ auditContainer ----------------- On the provider I see the following messages when accessing the accesslog: ----------------- Sep 08 19:45:54 ldapmaster slapd[2211]: conn=1058 fd=14 ACCEPT from IP=192.168.56.16:52338 (IP=0.0.0.0:636) Sep 08 19:45:54 ldapmaster slapd[2211]: conn=1058 fd=14 TLS established tls_ssf=256 ssf=256 Sep 08 19:45:54 ldapmaster slapd[2211]: conn=1058 op=0 BIND dn="cn=repl-user,ou=users,dc=example,dc=net" method=128 Sep 08 19:45:54 ldapmaster slapd[2211]: conn=1058 op=0 BIND dn="cn=repl-user,ou=users,dc=example,dc=net" mech=SIMPLE ssf=0 Sep 08 19:45:54 ldapmaster slapd[2211]: conn=1058 op=0 RESULT tag=97 err=0 text= Sep 08 19:45:54 ldapmaster slapd[2211]: conn=1058 op=1 SRCH base="cn=accesslog" scope=2 deref=0 filter="(&(objectClass=auditWriteObject)(reqResult=0))" Sep 08 19:45:54 ldapmaster slapd[2211]: conn=1058 op=1 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN Sep 08 19:45:54 ldapmaster slapd[2211]: conn=1058 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 08 19:45:54 ldapmaster slapd[2211]: conn=1058 op=2 UNBIND Sep 08 19:45:54 ldapmaster slapd[2211]: conn=1058 fd=14 closed ----------------- I see these messages even when I restart the consumer. So I think there is no problem with the access-permissions. any help is welcome :-) Stefan

4 16

RE: What does "slapcat: error writing output" means?
by Dario García Díaz-Miguel 29 Sep '20

29 Sep '20

About my last e-mail... I noticed that problem occurs when there is a head piped with the slapcat. I replaced: slapcat -d0 -c | head -n1 | awk -F "dn: " '{print $2}' With: slapcat -d0 -a "objectClass=dcObject" | grep ^dn | awk '{print $2}' And error disappeared. Thank you. Kind Regards. Dario Garcia Díaz-Miguel GGCS-SES Unit GGCS SKMF Infrastructure Division GMV C\ de Isaac Newton, 11 28760, Tres Cantos, Madrid España +34 918 07 21 00 +34 918 07 21 99 www.gmv.com -----Mensaje original----- De: Dario García Díaz-Miguel Enviado el: martes, 29 de septiembre de 2020 7:45 Para: 'openldap-technical(a)openldap.org' <openldap-technical(a)openldap.org> Asunto: What does "slapcat: error writing output" means? Hello everyone, I couldn't find an answer or explanation about this error, so I hope somebody could help me over here. I use slapcat with head, grep and awk to retrieve some information and store it into a variable for a shell/bash script. Whenever I use slapcat, the output prompts the following error: - slapcat: error writing output. However, the information looked for is correctly retrieved. What's the reason behind this message? Is there a way to address it or at least, ignore it and hiding it? I can't just redirect that output to /dev/null. Version: Openldap2-2.4.41-18.43.1 Suse 12 SP3 Thank you so much. Kind Regards. Dario Garcia Díaz-Miguel GGCS-SES Unit GGCS SKMF Infrastructure Division GMV C\ de Isaac Newton, 11 28760, Tres Cantos, Madrid España +34 918 07 21 00 +34 918 07 21 99 www.gmv.com P Please consider the environment before printing this e-mail.

1 0

openssl output
by Shaheena Kazi 24 Sep '20

24 Sep '20

Hello, I am using openssl - 1.1.1d Slapd Version - 2.4.47 I have complied slapd against the openssl to use the support ofTLSv1.3 The path is /opt/openssl/bin/openssl Now, I have a doubt, when I run the below command I get the expected output. /opt/openssl/bin/openssl s_client -connect localhost:636 But when I run /opt/openssl/bin/openssl s_client -connect localhost:389, I get the output as below: root@xxxxxxxxx# /opt/openssl/bin/openssl s_client -connect localhost:389 CONNECTED(00000003) write:errno=0 --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 293 bytes Verification: OK --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 0 (ok) --- +++++++++++++++++++++++++++++++++++++++++++++++++++++ Is this correct? I mean I dont face any issues but the output does not show the Protocol used. ++++++ As for the present openssl I get the below output where it shows the protocol used. root@cxxxxxxxxxxxx# openssl s_client -connect localhost:389 CONNECTED(00000003) write:errno=0 --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 176 bytes Verification: OK --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: PSK identity: None PSK identity hint: None SRP username: None Start Time: 1600959876 Timeout : 7200 (sec) Verify return code: 0 (ok) Extended master secret: no --- So I am wondering, If I am missing on anything or is it fine ?

2 2

Problems with syncrepl state
by Berthold Cogel 24 Sep '20

24 Sep '20

Hello, we have a cluster of LDAP servers consisting of one provider and 4 consumer. We're upgrading the os of the systems by proving an replacement system for each of the five systems. Then we stop the slapd on the system that should be replaced, dump the database with slapcat, copy it to new system, switch hostname and ip of both systems. We shut down the old and reboot the new system. Then we slapadd the database on the new system. So far so good... We started with the provider. After importing the database and starting the slapd on the new provider, we get errors for the syncrepl state on all consumer systems: "Can't get Context CSN with SID <x> from ldap+tls://localhost. Please set SID with -I option." We're using check_ldap_syncrepl_status from ltb-project with icinga2 to monitor the replication. I don't know how to fix this. When I modify an entry in the provider, it is synced to the consumer. But the status error stays. On all four consumers. I've then 'upgraded' a consumer by starting the slapd on the replacment system without any database. The system started the sync and after completion the error was gone. But syncing takes more time than importing a dump from a local file. And in a case where we have to rebuild the provider from scratch after a crash, it might be not an option to resync one consumer after the other to rebuild the complete cluster. Is there a method to fix the problem? Syncrepl configuration on the provider overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 Syncrepl configuration on the consumer syncrepl rid=<x> provider=ldap://yxz:389 binddn="cn=xxxxxxx" credentials="xxxxxxx" tls_cacertdir=/etc/pki/tls/certs tls_reqcert=demand bindmethod=simple starttls=critical searchbase="xxxxxx" type=refreshAndPersist retry="10 10 300 +" filter="(objectClass=*)" scope=sub attrs="*,+" sizelimit=unlimited timelimit=unlimited schemachecking=off Regards Berthold Cogel

3 8

How to delete root DIT
by mi.aleksio＠gmail.com 23 Sep '20

23 Sep '20

Hello all! I have test database: dn: olcDatabase=mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: mdb olcSuffix: dc=aleksio,dc=com olcRootDN: cn=Manager,dc=aleksio,dc=com # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd-config(5) for details. # Use of strong authentication encouraged. olcRootPW: 1 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. olcDbDirectory: /usr/local/var/openldap-data # Indices to maintain olcDbIndex: objectClass eq I created top record: dn: dc=aleksio,dc=com objectClass: dcObject objectClass: organization dc: aleksio o: myorg Record successfully created, I can search this record: ~# ldapsearch -x -w 1 o # extended LDIF # # LDAPv3 # base <dc=aleksio,dc=com> (default) with scope subtree # filter: (objectclass=*) # requesting: o # # aleksio.com dn: dc=aleksio,dc=com o: myorg # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Then I try to delete this record: ~# ldapdelete -x -w 1 'dc=aleksio,dc=com' ldap_delete: No such object (32) If I create child record in DN dc=aleksio,dc=com I can successfully delete this child record. How can I delete root record?

2 1

Why does OpenLDAP think my code didn't bind to the server?
by suryakalpo.sarker＠gmail.com 22 Sep '20

22 Sep '20

I'm trying to use the OpenLDAP C APIs to execute a search query against an AD. #include <ldap.h> #include <iostream> int main(void) { LDAP *ldp; auto ldap_version = LDAP_VERSION3; auto tls_cert_strat = LDAP_OPT_X_TLS_NEVER; //Never require identity cert from peer int err = ldap_initialize(&ldp,"ldap://1.1.1.1"); if (err != LDAP_SUCCESS) { std::cerr << "unable to connect" << std::endl; return -1; } std::cout << "connected, err == " << ldap_err2string(err) << "\n"; ldap_set_option(ldp, LDAP_OPT_PROTOCOL_VERSION, &ldap_version); //Set version to LDAPv3 ldap_set_option(ldp, LDAP_OPT_X_TLS_REQUIRE_CERT, &tls_cert_strat); err = ldap_start_tls_s(ldp, nullptr, nullptr); if (err != LDAP_SUCCESS) { char* msg; ldap_get_option(ldp, LDAP_OPT_DIAGNOSTIC_MESSAGE, &msg); std::cerr << "unable to upgrade to TLS! err: " << ldap_err2string(err) << std::endl; std::cerr << "diagnostic msg: " << msg << "\n"; ldap_memfree(msg); return -1; } std::cout << "start_tls request sent successfully, err == " << ldap_err2string(err) << "\n"; err = ldap_tls_inplace(ldp); if (err != 1) { char* msg; ldap_get_option(ldp, LDAP_OPT_DIAGNOSTIC_MESSAGE, &msg); std::cerr << "TLS handlers not installed! err: " << ldap_err2string(err) << std::endl; std::cerr << "diagnostic msg: " << msg << "\n"; ldap_memfree(msg); return -1; } std::cout << "TLS handlers have been installed sucessfully" << "\n"; //err = ldap_bind_s(ldp, "user(a)domain.com", "foo", LDAP_AUTH_SIMPLE); err = ldap_simple_bind_s(ldp, "user(a)domain.com", "foo"); if (err != LDAP_SUCCESS) { char* msg; ldap_get_option(ldp, LDAP_OPT_DIAGNOSTIC_MESSAGE, &msg); std::cerr << "Unable to bind to domain! err: " << ldap_err2string(err) << std::endl; std::cerr << "diagnostic msg: " << msg << "\n"; ldap_memfree(msg); return -1; } std::cout << "Successfully bound to DC\n"; char* base_dn = const_cast<char*>("dc=domain,dc=com"); char* filters = const_cast<char*>("userPrincipalName=user"); char* attr[4]; attr[0] = const_cast<char*>("samaccountname"); attr[1] = const_cast<char*>("cn"); attr[2] = const_cast<char*>("mail"); attr[3] = nullptr; LDAPMessage* ldp_msg; std::cout << "Executing LDAP search query\n"; err = ldap_search_ext_s(ldp, base_dn, LDAP_SCOPE_SUBTREE, filters, attr, 0, nullptr, nullptr, nullptr, 0, &ldp_msg); if (err != LDAP_SUCCESS) { char* msg; ldap_get_option(ldp, LDAP_OPT_DIAGNOSTIC_MESSAGE, &msg); std::cerr << "Unable to search domain! err: " << ldap_err2string(err) << std::endl; std::cerr << "diagnostic msg: " << msg << "\n"; ldap_memfree(msg); return -1; } std::cout << "Search executed successfully\n"; return 0; } I build the code as follows: g++8 -D LDAP_DEPRECATED -g -std=c++17 my_ldap.cpp -o my_ldap -l ldap But when I execute it, I get the following error: connected, err == Success start_tls request sent successfully, err == Success TLS handlers have been installed sucessfully Successfully bound to DC Executing LDAP search query Unable to search domain! err: Operations error diagnostic msg: 000004DC: LdapErr: DSID-0C0907E1, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580 This is where I'm confused: The diagnostic message says that I didn't bind, but given that ldap_simple_search_s returned LDAP_SUCCESS, that would mean that I did have a successful bind. I would understand if the search fails with a message citing lack of authorization, filter not matching, etc. The only other thing that I could think of is that I may have bound to one DN and executed a search against a different DN, but I checked for any typos several times, and nothing popped up. Just FYI, ldap_bind_s(ldp, "user(a)domain.com", "foo", LDAP_AUTH_SIMPLE) has the same behavior. Now, if the DC didn't like my bind/authentication method, I would imagine that would've caused an error during the bind call, but nothing of the sort happened. I thought about using the built-in debugging of the library as documented in the man pages for ldap_set_option, i.e. the LDAP_OPT_DEBUG_LEVEL option, but the code doesn't compile when I try to use one of the options as shown in the man page (incidentally none of those options are defined in ldap.h) I've tried a few other random (I'm saying random coz I doubt this is the cause) things too: a) Tried binding to the secure port directly instead of upgrading to TLS. b) Tried disabling LDAP_OPT_REFERRALS One strange thing that I observed though was that if the changed the syntax of the bind dn to "uid=user,dc=domain,dc=com" that would result in an "Invalid credentials" error from ldap_bind_s, but the "user(a)domain.com" format is accepted without any errors. I'm unable to check the contents of LDAP* in gdb because I cannot build the openldap port in freeBSD with non-stripped symbols (even though I built the port with debug support). What other angle should I be looking at to understand/resolve this problem?

2 1

error 53 text=consumer state is newer than provider!
by Stefan Kania 22 Sep '20

22 Sep '20

hi, replication is now running, but when I setup all three servers (one provider and two consumers) I get the following errormessage on the provider -------------------- SEARCH RESULT tag=101 err=53 nentries=0 text=consumer state is newer than provider! -------------------- And on the consumers: -------------------- syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) tid 1dc6e700 Sep 21 19:42:03 ldapslave-01 slapd[2360]: syncrepl_entry: rid=001 inserted UUID 61db79ba-907d-103a-80a6-2965db2a1bbb Sep 21 19:42:03 ldapslave-01 slapd[2360]: syncrepl_entry: rid=001 be_search (0) Sep 21 19:42:03 ldapslave-01 slapd[2360]: syncrepl_entry: rid=001 cn=ldap-admin,ou=users,dc=example,dc=net Sep 21 19:42:03 ldapslave-01 slapd[2360]: syncrepl_entry: rid=001 be_add cn=ldap-admin,ou=users,dc=example,dc=net (0) Sep 21 19:42:03 ldapslave-01 slapd[2360]: do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT Sep 21 19:42:03 ldapslave-01 slapd[2360]: do_syncrep2: rid=001 cookie=rid=001,csn=20200921174113.067710Z#000000#000#000000 Sep 21 19:42:03 ldapslave-01 slapd[2360]: slap_queue_csn: queueing 0x7f6714106290 20200921174113.067710Z#000000#000#000000 Sep 21 19:42:03 ldapslave-01 slapd[2360]: slap_graduate_commit_csn: removing 0x7f6714106290 20200921174113.067710Z#000000#000#000000 Sep 21 19:42:03 ldapslave-01 slapd[2360]: do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT Sep 21 19:42:03 ldapslave-01 slapd[2360]: do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT (53) Server is unwilling to perform Sep 21 19:42:03 ldapslave-01 slapd[2360]: do_syncrep2: rid=001 (53) Server is unwilling to perform -------------------- As soon as I do a modification with "ldapmodify" on the provider and then restart slad on the consumer everything is working fine. Is this normal? Or do I still have configured something wrong? Stefan

2 2

adding sortvals later
by Michael Ströder 17 Sep '20

17 Sep '20

HI! I vaguely remember having asked this before but I forgot the answer: Do I have to re-import or re-index the database when adding directive sortvals to a database containing affected entries? Ciao, Michael.

2 1

"rootDN must be defined before syncrepl may be used" and rootDN, rootpw in general
by Christopher Paul 17 Sep '20

17 Sep '20

Salutations OpenLDAP-Technical, I am thinking of rootDN and how I'm not a big fan of it. You don't need rootDN to configure OpenLDAP (assuming you first load OLC with slapadd). You don't need it to configure OLC if you've set up access to it for admin accounts. It ends up being one shared password that rules everything. Would it not be best to always give elevated access to specific accounts? Yes I understand without privileged admin access in the first place it's a chicken or egg situation to give access to admins but that can be solved with slapadd or slaptest to generate the initial configuration from a text file. And in some extreme cases, it's best to not evaluate access at all. This is the only reason I can think of for rootDN. It seems that syncrepl depends on it though, because when I try to configure a server without rootdn, rootpw and set up syncrepl, I get Other (e.g., implementation specific) error (80) additional info: rootDN must be defined before syncrepl may be used. What do people think about the need, utility, implications of having a password based root account? And why would rootDN need to be defined for syncrepl to work? Many thanks, -- Chris Paul Rex Consulting, Inc https://www.rexconsulting.net

2 3

@Quanah About your blog
by Stefan Kania 15 Sep '20

15 Sep '20

Hi Quanah, I got a question about your blog about MMR. You wrote: Add the syncprov and accesslog overlays to the existing primary database. Note that it will be renumber from dn: olcDatabase={2}mdb,cn=config to dn: olcDatabase={3}mdb,cn=config But you did not explain why you renumber the entry. Could you do tell me the reason ehy you did this? Thank you Stefan

3 4

deltasyncrepl in mirror node configuration
by Andreas Juretzka 11 Sep '20

11 Sep '20

Hi there, since I'm suspicious about some delays in between our master-master replication I'd like to ask you if it's possible to use deltasyncrepl with mirror node configuration? Our setup is two master in active passive mode behind an loadbalancer and several slaves. The deltasyncrepl works fine there. We only have sometimes problems with the active master to passive master replication. Especially when we have a lot of changes. The version is 2.4.50 running on debian 10. Thanks! Andreas -- Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-0 Fax: 030 / 405051-19 HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin

3 4

mdb and memory size...
by Frédéric Goudal 10 Sep '20

10 Sep '20

Hello, As I understand mdb database should be in memory. Is there a way to calculate the correct amount of memory that should be allocated to a server so the database fit with no swap ? I guess the maxsize attribute should be set to a correct value too.. Thanks in advance f.g.

3 4

memberof Overlay not showing in base search
by Umar Draz 10 Sep '20

10 Sep '20

Hi, I am running OpenLDAP server on Ubuntu 18. The memberOf attribute is not showing in ldap simple search, if I do the following then memberOf attribute is hidden. *ldapsearch -Y external -H ldapi:/// -b dc=example,dc=com* # udraz, Users, example.com <http://lablynx.com/> dn: uid=udraz,ou=Users,dc=example,dc=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount uid: udraz sn: Draz givenName: Umar mail: udraz(a)example.com cn: Umar Draz displayName: Umar Draz uidNumber: 5000 gidNumber: 5000 gecos: Umar Draz loginShell: /bin/bash homeDirectory: /home/udraz But if I do the following then memberOf attribute appear *ldapsearch -Y external -H ldapi:/// -b dc=example,dc=com memberOf* # udraz, Users, example.com dn: uid=udraz,ou=Users,dc=example,dc=com memberOf: cn=developers,ou=Users,dc=example,dc=com Would you please help me how to solve this

7 8

LDAP Tool Box packages (was: OpenLDAP 2.4.53 available)
by Clément OUDOT 09 Sep '20

09 Sep '20

Le lun. 7 sept. 2020 à 17:37, <project(a)openldap.org> a écrit : > > OpenLDAP 2.4.53 is now available for download as detailed on our download page: > > https://www.openldap.org/software/download/ LTB packages for OpenLDAP 2.4.53 are also available: https://projects.ow2.org/view/ldaptoolbox/ltb-openldap-2-4-53-packages-rele… Clément.

1 0

mdb_opinfo_get: err MDB_READERS_FULL: Environment maxreaders limit reached(-30790)
by Christopher Paul 08 Sep '20

08 Sep '20

Hello OpenLDAP-Technical, I am running slamd tests against OpenLDAP 2.4.44 (RHEL7; client is RHEL shop so stuck for now at this version). I realize that olcThreads: 128 is probably overkill for most systems, but when I tried it, I got the captioned error. The max that olcThreads can be set to it seems is 128 minus the number of syncrepls you have. Otherwise it looks like that with enough client connections, this error will happen, and operations will fail err=80 (internal error). -- Chris Paul Rex Consulting, Inc https://www.rexconsulting.net

2 2

acl for attrs with regex
by Stefan Kania 08 Sep '20

08 Sep '20

Hello, I would like to set ACLs to a bunch of attributes via ACL. Is it possible to use regular expressions in the <what>x field for attrs, someting like access to attrs.regex=[a.*] by ..... read by * break I couldn't figure it out :-( If it is possible could someone please write a short example Thank you Stefan

3 2

Segfault upgrading to OpenLDAP 2.5.52 from 2.4.50 with curse form the past
by Francesco Malvezzi 07 Sep '20

07 Sep '20

hi experts, good morning you all. My OpenLDAP milieu is a two providers in mirrormode and a few consumers. They are all at version 2.4.50. A few days ago I have tried to upgrade to 2.4.52 a couple of consumers. After a while slapd seg faults; in order to let it start again I need a full sync; but after sometime it stops again. Rolling back to 2.4.50 sets everything fine again. I noticed I didn't read the release note in version 2.4.50 that said I would need to export / import the database if I have been using ppolicy in those time and had changed pwdChangedTime with Relax control (both apply to my setup). Do I need to perform the export / import on the providers first? If providers have a clean database, does syncrepl take care to clean databases on consumers without further export / import? Can my present segfault be linked to the above issue? Or should have it called its toll before? Thank you so much for your time, Francesco

3 3

Symas OpenLDAP for Linux RHEL7 & RHEL8 2.4.53-1 now available
by Quanah Gibson-Mount 07 Sep '20

07 Sep '20

Symas OpenLDAP for Linux on RHEL7 and RHEL8 for OpenLDAP 2.4.53-1 are now available. As previously noted, the RHEL8 packages differ from the Red Hat packages in that they do not contain Red Hat's patch violating RFC 4513 and RFC 6125. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

groupOfNames vs. groupOfUniqueNames
by Olaf Hopp 07 Sep '20

07 Sep '20

Hi everybody, we are at the point of reorganising our LDAP. Currently we only have posixGroups, but in future we also want to support groupOfNames or groupOfUniqueNames My question what is the common sense of usage ? groupOfNames or groupOfUniqueNames ? I know your answers, you will say "it depends on your applications" but currently I have no application using it. All my current applications use my posixGroups. I just want to extend my LDAP for future use cases. So what to take : groupOf Names or groupOfUniqueNames besides posixGroup ? Regards, Olaf -- Karlsruher Institut für Technologie (KIT) ATIS - Abt. Technische Infrastruktur, Fakultät für Informatik Dipl.-Geophys. Olaf Hopp - Leitung IT-Dienste - Am Fasanengarten 5, Gebäude 50.34, Raum 009 76131 Karlsruhe Telefon: +49 721 608-43973 Fax: +49 721 608-46699 E-Mail: Olaf.Hopp(a)kit.edu atis.informatik.kit.edu www.kit.edu KIT – Die Forschungsuniversität in der Helmholtz-Gemeinschaft Das KIT ist seit 2010 als familiengerechte Hochschule zertifiziert.

5 7

Multiple LDAP admins
by Tayyab Saeed 07 Sep '20

07 Sep '20

Dear LDAP guys / Quanah, I want to create another LDAP administrative account with same or limited privileges. Kindly guide me or share any link which help to achieve the above goal. Thanks, Tayyab Saeed

3 4

OpenLDAP LTB packages (was: OpenLDAP 2.4.52 available)
by Clément OUDOT 06 Sep '20

06 Sep '20

Le ven. 28 août 2020 à 19:46, <project(a)openldap.org> a écrit : > > OpenLDAP 2.4.52 is now available for download Hello, LDAP Tool Box packages have been published (see announce: https://projects.ow2.org/view/ldaptoolbox/ltb-openldap-2-4-52-packages-rele…) We dropped support for Debian Wheezy, Debian Jessie and Centos/RHEL 6 as OpenLDAP 2.4.52 is requiring a version of OpenSSL that is not available on these systems. Cheers, Clément.

1 0

Re: Openldap performance question
by Amit Dongaonkar 04 Sep '20

04 Sep '20

Well I continue to read the documentation, however here are some observations: 1. Slapd is up and running all the time. 2. The service seems to go in a freeze mode for about 15 minutes or so and then responds again. 3. Once it starts responding and I attempt to change password (using self service password) it freezes again and does not respond for the next 15 minutes. 4. This behavior happens even when not attempting to change the password but just some basic searches using phpldapadmin. 5. The server is adequately providing the needed memory and computing resources so dont this that is causing the issue. Further any suggestions on what front end admin tool should be used with openldap. Thanks and Regards, *Amit Dongaonkar* On Fri, Sep 4, 2020 at 4:29 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Friday, September 4, 2020 5:12 PM -0400 Amit Dongaonkar > <amitd(a)nitssolutions.com> wrote: > > > As for the installation from the deb I was not aware the ubuntu provides > > its own build. > > > > > > After running the ldapwhoami the system takes some time to respond but > > eventually responds with > > "ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)" > > Sounds like either slapd is not running or you're attempting to connect in > an invalid fashion. I'd suggest doing some reading on how to use the ldap > client tools, how to start slapd, how to use and connect to slapd, etc. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

3 3

Re: Openldap performance question
by Amit Dongaonkar 04 Sep '20

04 Sep '20

Hi Quanah, My bad I should have stated those details earlier on. Here are the details: 1. Ubuntu: 20.04 2. Openldap release: OpenLDAP: slapd (Ubuntu) (Jun 12 2020 22:18:58) $ Debian OpenLDAP Maintainers < pkg-openldap-devel(a)lists.alioth.debian.org> 3. Openldap backend : MDB As for the installation from the deb I was not aware the ubuntu provides its own build. After running the ldapwhoami the system takes some time to respond but eventually responds with "ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)" Thanks and Regards, *Amit Dongaonkar* On Fri, Sep 4, 2020 at 4:05 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Friday, September 4, 2020 4:48 PM -0400 Amit Dongaonkar > <amitd(a)nitssolutions.com> wrote: > > > > > > > Hello group, > > I have just installed openldap on ubuntu using a .deb file and have > > installed phpldapadmin on top to work with the directory. > > I see a lot of performance issue while accessing via phpldapadmin when > > even trying to login to ldap. > > At times it works perfectly well and other times it just keeps dragging > > for ever. > > I just have about 5-6 entries in the ldap db so far. > > Aside from everything else, I'd suggest not using PHPldapadmin, it's known > to have various issues. You also have not stated what Ubuntu release, > OpenLDAP release, or OpenLDAP backend you're using. Since Ubuntu already > provides OpenLDAP builds, it's not clear to me why you'd install it from a > deb. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Openldap performance question
by Amit Dongaonkar 04 Sep '20

04 Sep '20

Hello group, I have just installed openldap on ubuntu using a .deb file and have installed phpldapadmin on top to work with the directory. I see a lot of performance issue while accessing via phpldapadmin when even trying to login to ldap. At times it works perfectly well and other times it just keeps dragging for ever. I just have about 5-6 entries in the ldap db so far. Any help/pointers will be appreciated. Thanks and Regards, *Amit Dongaonkar*

3 3

git repository build
by Nick Folino 01 Sep '20

01 Sep '20

Did a recent change break building from git? Make install is erroring off. I wiped my repo, cloned from https://github.com/openldap/openldap.git and tried a clean configure/make depend/make all went well. Make install not so well. Looks like the install is executing the tools: Making install in /home/nick/git/openldap/clients Entering subdirectory tools make[2]: Entering directory '/home/nick/git/openldap/clients/tools' ../../build/shtool mkdir -p /apps/openldap/bin libtool: install: ../../build/shtool install -c -m 755 -s ldapsearch /apps/openldap/bin/ldapsearch ldap_sasl_interactive_bind: Can't contact LDAP server (-1) libtool: install: ../../build/shtool install -c -m 755 -s ldapmodify /apps/openldap/bin/ldapmodify ldap_sasl_interactive_bind: Can't contact LDAP server (-1) libtool: install: ../../build/shtool install -c -m 755 -s ldapdelete /apps/openldap/bin/ldapdelete ldap_sasl_interactive_bind: Can't contact LDAP server (-1) libtool: install: ../../build/shtool install -c -m 755 -s ldapmodrdn /apps/openldap/bin/ldapmodrdn ldap_sasl_interactive_bind: Can't contact LDAP server (-1) libtool: install: ../../build/shtool install -c -m 755 -s ldappasswd /apps/openldap/bin/ldappasswd ldap_sasl_interactive_bind: Can't contact LDAP server (-1) libtool: install: ../../build/shtool install -c -m 755 -s ldapwhoami /apps/openldap/bin/ldapwhoami ldap_sasl_interactive_bind: Can't contact LDAP server (-1) libtool: install: ../../build/shtool install -c -m 755 -s ldapvc /apps/openldap/bin/ldapvc ldap_sasl_interactive_bind: Can't contact LDAP server (-1) libtool: install: ../../build/shtool install -c -m 755 -s ldapcompare /apps/openldap/bin/ldapcompare usage: #INST@1151854# [options] DN <attr:value|attr::b64value> where: DN Distinguished Name attr assertion attribute value assertion value b64value base64 encoding of assertion value Nick

2 4

Resyncing basic question..
by Frédéric Goudal 01 Sep '20

01 Sep '20

Hello, I’m wondering about the correct way to resync a directory in a push configuration… The setup is the following (as described in the documentation) : - on the master I have added a second suffix with the hidden property and the same suffix value. - this suffix have an ldap backend on another computer which is the real slave. I know the procedure to resynchronize two directory when the slave is in a pull configuration : get the csn of the master and restart the slave with the csn as argument. But in the push configuration : do I need to restart the slave (the backend of the second suffix ) ? Or the master which deals with the hidden suffix ? I hope my explanation are clear. Thanks in advance. f.g.

3 3

how to clean old multiple CSN ?
by Frédéric Goudal 31 Aug '20

31 Aug '20

Hello, I have an ldap master that from some reason has multiple CSN : contextCSN: 20130927152219.157851Z#000000#001#000000 contextCSN: 20131127140429.597497Z#000000#002#000000 contextCSN: 20141208130549.278599Z#000000#004#000000 contextCSN: 20200831094837.531411Z#000000#00a#000000 Some are quite old. I don’t know why they are here. Is there a way to clean the old Context CSN ? f.g.

2 1

Acl attribute access
by Marc Roos 31 Aug '20

31 Aug '20

If I have this acl: to dn="sendmailMTAKey=test(a)bbbbb.com,ou=eeee,ou=ddddd,ou=ccccc,dc=bbbbb,dc= aaaaa,dc=local" by ssf=64 dn.exact="uid=acctest,ou=ffff,ou=ddddd,ou=ccccc,dc=bbbbb,dc=aaaaa,dc=loc al" read I can access with this ldap search: ldapsearch -LLL -W -s sub -b "sendmailMTAKey=test(a)bbbbb.com,ou=eeee,ou=ddddd,ou=ccccc,dc=bbbbb,dc=aaa aa,dc=local" -D "uid=acctest,ou=ffff,ou=ddddd,ou=ccccc,dc=bbbbb,dc=aaaaa,dc=local" -H ldaps://ldap.local sendmailMTAKey If I change the acl to to dn="sendmailMTAKey=test(a)bbbbb.com,ou=eeee,ou=ddddd,ou=ccccc,dc=bbbbb,dc= aaaaa,dc=local" attrs="sendmailMTAKey" by ssf=64 dn.exact="uid=acctest,ou=ffff,ou=ddddd,ou=ccccc,dc=bbbbb,dc=aaaaa,dc=loc al" read The ldapsearch is not returning any object. How to resolve this?

3 7

Acl with variable in filter
by Marc Roos 31 Aug '20

31 Aug '20

Is it possible to have a variable VAR in an acl filter? Something like this: to dn="sendmailMTAKey=test(a)bbbbb.com,ou=eeee,ou=ddddd,ou=ccccc,dc=bbbbb,dc= aaaaa,dc=local" filter="(sendmailMTAMapValue=VAR1) by ssf=64 dn.exact="uid=VAR1,ou=ffff,ou=ddddd,ou=ccccc,dc=bbbbb,dc=aaaaa,dc=local" read

1 1

user | this expansion in acl
by Marc Roos 31 Aug '20

31 Aug '20

I am not getting this page. Maybe there should be an example or so. I can use user anywhere in the acls and it will expand to the dn of the binddn of the ldapsearch request? user | this : resolves to the set { "cn=User,cn=adfasdfa,cn=asdfadfa,ou=asdfasdfas,ou=adsasdfasdf", "cn=Resource" } How can I get only 'User' and not the whole dn also not 'cn=User'? [1] https://www.openldap.org/faq/data/cache/1133.html

1 0

LMDB: iterating over the whole DB
by Vladimír Čunát 31 Aug '20

31 Aug '20

Hello. (I sent the same message 24h ago before subscribing, but it hasn't arrived so far. I hope you won't see a duplicate later.) We have a process that needs to analyze the contents of a whole LMDB. So far the approach was to open a read-only transaction and use a cursor to iterate over the whole contents in order. This long transaction apparently causes other concurrent process(es) to get MDB_MAP_FULL from mdb_put() even though that LMDB has plenty free pages at that moment. That would be a big problem for us, but fortunately we don't need the analysis to be atomic and splitting that iterating into smaller transactions seems to avoid the problem. That were just experiments without understanding why exactly it happens (though I get that long transactions are generally problematic). Could this behavior be considered a bug in LMDB? Is there a way of either distinguishing this MDB_MAP_FULL event from really full LMDB or avoiding it with confidence? (We only experimented with the number of keys accessed in one transaction.) By the way, thanks a lot for LMDB! --Vladimir https://knot-resolver.cz

3 6

OpenLDAP and Ansible
by Stefan Kania 31 Aug '20

31 Aug '20

I wrote some Ansible roles to set up a testing environment, mybe someone is interested in testing the roles. You can find all files and a descripton on my page: https://www.kania-online.de/using-ansible-to-set-up-an-openldap-environment/

3 3

Re: Antw: [EXT] Re: Have daemon reload rotated certs
by David Arnold 31 Aug '20

31 Aug '20

> Or maybe just check the modification time of the file from time to > time and re-initialize if files did change. > In Linux you could even set up a file change notification. I think > cron detects crontab changes that way (failing on symbolic links). I'm trying to make OpenLDAP play in concert with SPIFFE workload api. I figured a frontend overlay would be the right choice if I were to implement the whole of the SPIFFE workload attestation API in it. Maybe that would be a good thing to do, but I'm seriously constrained by my (nonexistent) C skillset, so my options are unfortunately somewhat limited. On the other hand, different folks might wish to roll their certificates differently without using SPIFFE (will SPIFFE prevail?). So I think the most useful solution for OpenLDAP users in a general sense would be OpenLDAP to recreate ssl contexts if it detects the current one got expired. I started looking at the code and was thinking on how to modify <https://git.openldap.org/openldap/openldap/-/blob/master/libraries/libldap/…> > #define HAS_TLS( sb ) ber_sockbuf_ctrl( sb, LBER_SB_OPT_HAS_IO, \ > (void *)tls_imp->ti_sbio ) It is used to check if a TLS context exists on the socket, and if not creates one. Modified semantics, that would perfectly cover the use case would check if the socket has a non-expired tls context. If expired, delete it and create it (exactly once and if still expired, bail out with an error) and if non-existent, create it (as currently implemented). Maybe directly implemented in `ldap_pvt_tls_accept` & `ldap_int_tls_connect` > if ( HAS_TLS( sb )) { > ber_sockbuf_ctrl( sb, LBER_SB_OPT_GET_SSL, (void *)&ssl ); > } else { But then I wonder if it's a good idea to reset the context out of tls2.c? And what's the difference between default tls context and other tls context? I understand the difference between a server tls and a non-server tls contexts, but how do I tell which is which? Does such a design make sense? - Note, I'm happy with a works for me patch, but if such thing would grow generally useful and would be accepted, I'd be more than happy. Best Regards, David A. On Mon, Aug 24, 2020 at 08:11, Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: >>>> David Arnold <dar(a)xoe.solutions <mailto:dar@xoe.solutions>> >>>> schrieb am 21.08.2020 um 23:53 in Nachricht > <7TOFFQ.C256O3KUUI8O1(a)xoe.solutions > <mailto:7TOFFQ.C256O3KUUI8O1@xoe.solutions>>: > > [...] >> Furthermore, would this dummy change also reload the certificates >> that >> are configured for the syncrepls? > > If your do not replicate cn=config, then: No. > > [...] >> I'm starting to think plain process signalling for reloading the TLS >> context would actually be a cleaner, more elegant and stable >> solution. > > Or maybe just check the modification time of the file from time to > time and re-initialize if files did change. > In Linux you could even set up a file change notification. I think > cron detects crontab changes that way (failing on symbolic links). > >> Would you be ok if I opened an issue for that? > [...] > > Regards, > Ulrich > >

2 4

RE24 testing call #2 (OpenLDAP 2.4.52)
by Quanah Gibson-Mount 28 Aug '20

28 Aug '20

This is the second testing call for OpenLDAP 2.4.52. Depending on the results, this may be the final testing call. Generally, get the code for RE24: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_4/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && "make its" to run through the regression suite. Thanks! OpenLDAP 2.4.52 Engineering Added libldap LDAP_OPT_X_TLS_REQUIRE_SAN option (ITS#9318) Added libldap OpenSSL support for multiple EECDH curves (ITS#9054) Added slapd OpenSSL support for multiple EECDH curves (ITS#9054) Fixed librewrite malloc/free corruption (ITS#9249) Fixed libldap hang when using UDP and server down (ITS#9328) Fixed slapd syncrepl rare deadlock due to network issues (ITS#9324) Fixed slapd syncrepl regression that could trigger an assert (ITS#9329) Fixed slapd-mdb index error with collapsed range (ITS#9135) Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

6 7

Re: RE24 testing call #2 (OpenLDAP 2.4.52)
by Nick Folino 28 Aug '20

28 Aug '20

No issues on Fedora 32 - 5.7.17-200.fc32.x86_64 I no longer build with bdb/hdb 3 different computers with the following processors: AMD Ryzen 5 2500U Intel Xeon E5630 Intel Core i5-3470 On Thu, Aug 27, 2020 at 9:37 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > This is the second testing call for OpenLDAP 2.4.52. Depending on the > results, this may be the final testing call. > > Generally, get the code for RE24: > > < > https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_4/o… > > > > Extract, configure, and build. > > Execute the test suite (via make test) after it is built. Optionally, cd > tests && "make its" to run through the regression suite. > > Thanks! > > > OpenLDAP 2.4.52 Engineering > Added libldap LDAP_OPT_X_TLS_REQUIRE_SAN option (ITS#9318) > Added libldap OpenSSL support for multiple EECDH curves (ITS#9054) > Added slapd OpenSSL support for multiple EECDH curves (ITS#9054) > Fixed librewrite malloc/free corruption (ITS#9249) > Fixed libldap hang when using UDP and server down (ITS#9328) > Fixed slapd syncrepl rare deadlock due to network issues (ITS#9324) > Fixed slapd syncrepl regression that could trigger an assert > (ITS#9329) > Fixed slapd-mdb index error with collapsed range (ITS#9135) > > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

RE24 testing call #1 (OpenLDAP 2.4.52)
by Quanah Gibson-Mount 27 Aug '20

27 Aug '20

This is the first testing call for OpenLDAP 2.4.52. Depending on the results, this may be the only testing call. Generally, get the code for RE24: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_4/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.4.52 Engineering Added libldap LDAP_OPT_X_TLS_REQUIRE_SAN option (ITS#9318) Added libldap OpenSSL support for multiple EECDH curves (ITS#9054) Added slapd OpenSSL support for multiple EECDH curves (ITS#9054) Fixed librewrite malloc/free corruption (ITS#9249) Fixed libldap hang when using UDP and server down (ITS#9328) Fixed slapd syncrepl rare deadlock due to network issues (ITS#9324) Fixed slapd syncrepl regression that could trigger an assert (ITS#9329) Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

4 5

Re: RE24 testing call #1 (OpenLDAP 2.4.52)
by Braiam 27 Aug '20

27 Aug '20

On Wed, Aug 26, 2020 at 7:07 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > Execute the test suite (via make test) after it is built. Optionally, cd > tests && make its to run through the regression suite. Can't run the regression suite. ➜ tests make Making all in /«BUILDDIR»/openldap-OPENLDAP_REL_ENG_2_4/tests Entering subdirectory progs make[1]: Entering directory '/«BUILDDIR»/openldap-OPENLDAP_REL_ENG_2_4/tests/progs' make[1]: Nothing to be done for 'all'. make[1]: Leaving directory '/«BUILDDIR»/openldap-OPENLDAP_REL_ENG_2_4/tests/progs' -- Braiam

2 1

Arbitrary Root CA works for TLS/SSL verification
by Dalton Zhang 26 Aug '20

26 Aug '20

My /etc/openldap/ldap.conf file include the following, #TLS_CACERT /etc/pki/CA/certs/chain2root.pem #TLS_CACERT /etc/openldap/cacerts/fc5a8fxx.0 TLS_REQCERT demand The two CAs are from different signers, but "ldapwhoami -x -ZZ" will output Anonymous (means TLS/SSL is working) when one of the two TLS_CACERT lines is uncommented. Actually the first is the right one, I just didn't expect that the second one also work. If both are commented, I get the following error, ldap_start_tls: Connect error (-11) additional info: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed (self signed certificate in certificate chain) Can someone help me to understand what's wrong? Dalton

2 2

Have daemon reload rotated certs
by David Arnold 22 Aug '20

22 Aug '20

Hello, I'm using SPIRE/SPIFFE for workload attestation and authC, work brilliant in combination with the spiffe-helper. The spiffe helper communicates with the workload attestation API over a linux socket and provides and rotates the certificates, and then starts the actual daemon process (slapd in our case). Every 5 minutes certificates are rotated and the helper proactively requests new certs at 80% of TTL. It goes on to provision the newly supplied certs and then signals the daemon process to reload (config-reload, certs-reload, restart, whatever) through a configurable singal (eg. SIGHUP). An alternative is to run the daemon independently and run the helper as a sidecar process which then communicates with the daemon process through other means (unix socket, TCP socket) to communicate the need for configuration reload. I - think - I understood that slapd does not have a SIGNAL API by which I can tell it to reload certificates (or subsidiarily configuration). Neither did I find a signal which causes slapd to restart, which still would be acceptable. Hece I figure, my only option is to deploy the helper as a sidecar process and have it cause the slapd daemon to reload its config over the ldap protocol. For postgres, such thing is achieved similarily for exmample by the query "SELECT pg_reload_config();". What are my options in ldap - given that slapd.conf is used by the underlying system, unfortunately not dn=config (olc)? Thank you in advance for your help! Best Regards, David Arnold

4 12

Symas OpenLDAP for Linux RHEL7 & RHEL8 2.4.51-1 now available
by Quanah Gibson-Mount 22 Aug '20

22 Aug '20

Symas OpenLDAP for Linux on RHEL7 and RHEL8 for OpenLDAP 2.4.51-1 are now available. As previously noted, the RHEL8 packages differ from the Red Hat packages in that they do not contain Red Hat's patch violating RFC 4513 and RFC 6125. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

mdb data encryption
by Rallavagu Kon 22 Aug '20

22 Aug '20

Hello All, Wondering if there are options to encrypt data at rest while using mdb as backend for OpenLDAP 2.4. Thanks

2 1

Symas OpenLDAP for Linux on RHEL 8 divergence
by Quanah Gibson-Mount 20 Aug '20

20 Aug '20

Hello OpenLDAP community, Due to the issues with RFC 6125 discussed in <https://lists.openldap.org/hyperkitty/list/openldap-announce@openldap.org/t…> and Red Hat's decision to improperly patch "support" for RFC 6125 into their Enterprise Linux 8 package of libldap <https://lists.openldap.org/hyperkitty/list/openldap-announce@openldap.org/t…>, Symas OpenLDAP for Linux on RHEL8 will diverge from Red Hat in this regard starting with the Symas OpenLDAP for Linux on RHEL 8 version 2.4.51-1 release. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Question: rfc2307 vs rfc2307bis with multimaster replication
by Dave Macias 20 Aug '20

20 Aug '20

I see. Well, I think for starters i will move forward with version upgrade and eventually delta-sync. Then I’ll comeback to this post. Thank you always for the awesome support!! Stay safe. -Dave On Aug 18, 2020, 6:57 PM -0400, Quanah Gibson-Mount <quanah(a)symas.com>, wrote: > > > --On Tuesday, August 18, 2020 7:42 PM -0400 Dave Macias <davama(a)gmail.com> > wrote: > > > No, using syncrepl. Should we move to delta-syncrepl? > > Due to ITS#8125 which can't be fixed until 2.5, it's essentially mandatory > if you want reliable replication in the 2.4 series. > > > I can agree with that. We are using the distro provided openldap package > > and it's pretty key to our infrastructure. So having it up to date is > > good. We have already tested this before and the migration to symas > > openldap is very easy! Thank you for that. > > > > At least with my previous questions, are they any concerns in 2.4.51? > > I had a long list of questions related to your previous questions. Without > answers to those questions, I can't say much more. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com>

1 0

Can't build openldap 2.4.44 with OpenSSL - openssl-1.1.1d
by Shaheena Kazi 20 Aug '20

20 Aug '20

Hi, I am on debian stretch. The openldap im using is 2.4.44. I am trying to compile OpenSSL - openssl-1.1.1d with openldap 2.4.44. But it fails with the below message configure: error: Could not locate TLS/SSL package. Can someone help me here ?

2 2

Enable and Disable a user account in OpenLDAP using various methods, CLI, GUI, etc.
by wbranson＠mcw.edu 19 Aug '20

19 Aug '20

Hello, My apologies if this is in the wrong place. I am getting ready to migrate from NIS to LDAP in our HPC clusters. I need to know how to disable a user account, that is not to delete it, but to temporarily disable it. My current GUI to access LDAP is Apache Directory Studio. I also have the standard command line commands, ldapmodify , etc. So I have been looking around in various places. I saw some videos on YouTube for adding users with Apache. I can do most of the tasks listed for Apache Directory Studio. However, I have not used command line other than to add, delete or modify users and searches, oh and create some lidf files. My past experiences with LDAP and IDM products are based around UNIX based systems and applications "Sun™ Java System Directory Server 5.x and 6.x" and "Sun™ Identity Manager". I have also used Active Directory on the Microsoft side. So I have a better than average understanding of things, I just need to know this specific task. So if it is possible in OpenLDAP, to disable and enable users can anyone point me to a document or a YouTube Video or any information. Thank you so much for your assistance, in advance. Sincerely Bill Branson Server Engineer II | Research Computing Center Medical College of Wisconsin 414-955-2475 | wbranson(a)mcw.edu

4 3

Disabling memberOf as a built-in
by svenj＠uic.edu 19 Aug '20

19 Aug '20

Is there a configuration flag I can use to allow me to define memberOf in the schemas, rather than having it be a 'built-in' of OpenLDAP. Thanks in advance.

2 3

Re: Question: rfc2307 vs rfc2307bis with multimaster replication
by Dave Macias 19 Aug '20

19 Aug '20

> You need to upgrade, 2.4.44 is about 4.5 years old and numerous significant > bugs have been fixed with replication since then. It's absolutely unsafe > to use 2.4.44 for MPR (also, I'm going to assume you're correctly using > delta-syncrepl). 2.4.51 is the current release, change log is here: > > <https://www.openldap.org/software/release/changes.html> Thank you for the quick reply and reference. No, using syncrepl. Should we move to delta-syncrepl? I can agree with that. We are using the distro provided openldap package and it’s pretty key to our infrastructure. So having it up to date is good. We have already tested this before and the migration to symas openldap is very easy! Thank you for that. At least with my previous questions, are they any concerns in 2.4.51?

2 1

Question: rfc2307 vs rfc2307bis with multimaster replication
by Dave Macias 19 Aug '20

19 Aug '20

Hello, Hope everyone is staying safe and healthy. Currently running 2.4.44 with n-way multi-master setup with rfc2307 schema. We have tested rfc2307bis before on our lab environment with no issues but never deployed to production. Some of the benefits I remember about this test is the cool features like “reverse group membership” and “referential integrity” which are not possible with rfc2307. My question is two part: 1. Is switching to rfc2307bis recommended? Better performance? 2. Any issues with n-way multimaster replication? Thank you always for the continued support! Regards, Dave

2 1

LMDB nosync with write order preserving filesystem
by Gábor Melis 18 Aug '20

18 Aug '20

The documentation of MDB_NOSYNC says: If the filesystem preserves write order and the MDB_WRITEMAP flag is not used, transactions exhibit ACI (atomicity, consistency, isolation) properties and only lose D (durability). In practice, what file system + options preserve write order? Asked this question elsewhere from Howard. I got the answer that ZFS should do it, and ext4 with data=ordered _may_ do it. It seems to me that ext4 with data=journal should be a very safe bet, too, would it not? Are there any other recommendations? I ran a few microbenchmarks to compare ext4 data=ordered and data=journal. With the default sync, they can do about 600 and 400 write txn/s. With nosync + an mdb_env_sync() every second, they are both at about 200k txn/s. For reference, the system can do about 5 million read txn/s. That makes me hopeful that ext4 with data=journal could be a good option. Cheers, Gábor Melis

2 2

Multi Master Replication Error - Got Search Entry Without Sync State Control
by alexander.jarrard＠pfizer.com 17 Aug '20

17 Aug '20

Hi There, We are in the middle of implementing OpenLDAP into our network. We are testing our implementation and facing the below error in our logs after a node has either been powered off or the slapd service has been stopped (and subsequently brought back online): syncprov_sendresp: cookie=rid=001,sid=001,csn=20200813144529.184309Z#000000#001#000000 do_syncrep2: rid=002 got search entry without Sync State control (dc=domain,dc=local) do_syncrepl: rid=002 rc -1 retrying syncprov_sendresp: cookie=rid=001,sid=001,csn=20200813144529.378496Z#000000#001#000000 This error is only encountered on the node that had been brought offline. Prior to this replication had/has been working without issue - as far as we can tell. Below are the configuration LDIFs we used to enable replication: dn: cn=config changetype: modify add: olcServerID olcServerID: 1 ldap://ldap1.domain.local/ olcServerID: 2 ldap://ldap2.domain.local/ dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: syncprov.la dn: olcOverlay=syncprov,olcDatabase={3}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={3}mdb,cn=config changetype:modify add: olcSyncrepl olcSyncrepl: rid=001 provider=ldap://ldap1.domain.local/ binddn="cn=manager,dc=domain,dc=local" bindmethod=simple credentials=ldap_pw searchbase="dc=domain,dc=local" type=refreshAndPersist retry="5 5 300 +" timeout=1 olcSyncrepl: rid=002 provider=ldap://ldap2.domain.local/ binddn="cn=manager,dc=domain,dc=local" bindmethod=simple credentials=ldap_pw searchbase="dc=domain,dc=local" type=refreshAndPersist retry="5 5 300 +" timeout=1 - add: olcMirrorMode olcMirrorMode: TRUE I have seen other posts about this error that mention the overlay not being properly configured, however, I don't think this is the case for us since replication does work as expected until a node is brought offline. It also seems that any changes made to online nodes are not replicated to the offline node when it is brought back online. However, any changes made after that node has been brought back online are replicated. I am sure this is probably a configuration issue but not sure where to go from here. Any help is greatly appreciated. Thanks!

4 6

Re: LDAP Tool Box packages [was: OpenLDAP 2.4.51 available, LMDB 0.9.26 available]
by Giuseppe De Marco 17 Aug '20

17 Aug '20

Bad news Quanah, I think that there would the need to have many pluggable storages with an abstract layer in between. NoSQL, SQL and others (like elastic search) are so many important storage engines nowadays, It would be awesome to have them in slapd. Replication would works only on mdb, because each storage engines would have their own Il lun 17 ago 2020, 17:37 Quanah Gibson-Mount <quanah(a)symas.com> ha scritto: > > > --On Monday, August 17, 2020 5:36 PM +0200 Clément OUDOT > <clem.oudot(a)gmail.com> wrote: > > > Is there any possibilities to have in ltb the SQL backend in future > > releases? > > I would note that back-sql is considered experimental, is extremely buggy, > and has been retired for the 2.5 release. Unless someone steps up to > maintain and fix it to a functional state, it will likely be removed > entirely at some point in the future. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > -- ------------------------------------------------------------------------------------------------------------------ Il banner è generato automaticamente dal servizio di posta elettronica dell'Università della Calabria <https://www.unical.it/portale/portaltemplates/view/view.cfm?100061>

2 1

LDAP Tool Box packages [was: OpenLDAP 2.4.51 available, LMDB 0.9.26 available]
by Clément OUDOT 17 Aug '20

17 Aug '20

Hello, LDAP Tool Box packages for OpenLDAP 2.4.51 are released. They can be downloaded on https://ltb-project.org/download#openldap or installed with yum/apt Thanks again to OpenLDAP team for their great work! Clément.

3 3

LMDB alignment of values
by Gábor Melis 14 Aug '20

14 Aug '20

I understand that at some points keys were aligned to 2 bytes and maybe values, too: https://github.com/AltSysrq/lmdb-zero/issues/8 Maybe that's still the case. However a solution I'm looking at needs double word (16 bytes on 64 bit) alignment of values. This would allow using the value directly as a read-only Lisp object. Leaving whether that's a good idea aside, is there any way to guarantee double word alignment of values? My preliminary hacks involving varying the key size were not successful. Cheers, Gábor Melis

2 1

LMDB safety under misuse
by Gábor Melis 14 Aug '20

14 Aug '20

Hello I'm writing a Common Lisp wrapper for LMDB, starting where the previous efforts left off. I have a number of questions related to safety and the color of the smoke after a disaster. 1. lmdb.h says that "A parent transaction and its cursors may not issue any other operations than mdb_txn_commit and mdb_txn_abort while it has active child transactions." What I observe is that when a cursor associated with the parent transaction is used in the child, there are no errors and the cursor behaves (my test only involved mdb_cursor_put and MDB_SET_KEY) as if it belonged to the child. Is this to be expected in general or my tests are insufficient and something really bad can happen? If this is a disaster waiting to happen, I need to add checks to the cursor code. 2. mdb_txns are calloc()ed and free()d. In the case where a thread performs some operation (e.g. put, get, del) involving an already freed mdb_txn pointer, what kind of nastiness can happen? Can the database be corrupted? 3. Same question about mdb_cursors. 4. Async unwind safety. This is a bit like a thread being destroyed in the middle of an lmdb function call. Context: In some Common Lisp implementations (SBCL), Posix interrupts like SIGINT are used during development. If the developer presses C-c the lisp debugger will start where the signal handler was invoked, which may be in the middle of some mdb_* call. Depending on the actions taken, the stack (both the lisp and the C stack) may be unwound to some earlier frame. Another example is async timeouts (SBCL's WITH-TIMEOUT) can also unwind the stack. I understand that async unwinds are unsafe in general. There is a way to defer handling of interrupts, which I already use to protect allocations (mdb_txn_begin, mdb_txn_commit and similar), but it has a small performance cost and I hesitate to apply it to performance hotspots (e.g. put, get, del and most cursor ops). Are [some of] these functions safe in face of async unwinds? What kind of problem may arise? Cheers, Gábor Melis

3 5

Race condition with groupOfNames using syncrepl
by Jonathan Steel 13 Aug '20

13 Aug '20

Hi, When trying to sync our LDAP data to a consumer, the consumer errors with: null_callback : error code 0x13 syncrepl_entry: rid=002 be_add cn=mygroup,ou=Group,dc=domain,dc=com failed (19) I believe this is because it is a groupOfNames (list of member DNs) that do not yet exist on the consumer. If I sync with a filter to exclude the groupOfNames entries, it completes fine, which confirms it is only having an issue with groupOfNames: filter="(!(objectClass=groupOfNames))" Can you advise if this is a known issue, and if there's a way to work around it, short of importing the LDAP data manually? I wonder if there's a way to skip errors, so it will skip the groupOfNames and retry once the users have been created. Best regards, Jonathan

3 5

Acl for admin group
by Клеусов Владимир Сергеевич 13 Aug '20

13 Aug '20

Hi Sorry for the banal question I created an acl for a group whose members have full access to OpenLDAP. dn: olcDatabase={1}mdb,cn=config changetype: modify replace: olcAccess olcAccess: to attrs=userPassword by self write by group.exact="cn=ldap_admins,ou=Groups,dc=domain,dc=com" write by anonymous auth by * none olcAccess: to * by self write by group.exact="cn=ldap_admins,ou=Groups,dc=domain,dc=com write by * read But members of this group didn't get full access. Please tell me what I did wrong ?

3 10

Re: TLSv1.3 support on openldap 2.4.44
by Shaheena Kazi 12 Aug '20

12 Aug '20

My product is a security product and hence I would like to stick to 2.4.44 or a version provided by buster i.e., 2.4.47. May be 2.4.47 is a better option. What do you think? On Tue, 11 Aug 2020 at 11:57 PM, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Wednesday, August 12, 2020 12:43 AM +0530 Shaheena Kazi > <shaheena.kazi(a)gmail.com> wrote: > > > > > Hi Team, > > > > > > I wanted to know if TLSv1.3 is supported on openldap 2.4.44. > > openssl packge which I would be using is - openssl-1.1.1d.tar.bz2 to > > compile openldap. > > If you are building OpenLDAP yourself, you should use the most current > release, not one that's over four years old. > > Build OpenLDAP 2.4.50, and it has TLS 1.3 support as long as the SSL > library does. > > Regards, > Quanah > > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > -- Regards, Shaheena K

4 3

TLSv1.3 support on openldap 2.4.44
by Shaheena Kazi 11 Aug '20

11 Aug '20

Hi Team, I wanted to know if TLSv1.3 is supported on openldap 2.4.44. openssl packge which I would be using is - openssl-1.1.1d.tar.bz2 to compile openldap. Awaiting your reply. Regards, Shaheena K

2 1

Switching roles between 2 DCs
by Lothar Schilling 11 Aug '20

11 Aug '20

Dear Mr. Kania, setting up a DC with Samba 4 and OpenLDAP I am still going exactly by the rules in your book. I got to the point where I would switch, just testing, roles from DC1 to DC2 and vice versa. Switching all roles from DC1 to DC 2 was a piece of cake, reswitching "domaindns" and "forestdns" to DC1 wasn't, though: samba-tool fsmo transfer --role=domaindns -k yes Password for [MY_DOMAIN\root]: Failed to bind - LDAP client internal error: NT_STATUS_LOGON_FAILURE Failed to connect to 'ldap://1b3fd128-1bd3-40fb-bc6c-9f943cac6e9e._msdcs.MY_DOMAIN.NEW' with backend 'ldap': LDAP client internal error: NT_STATUS_LOGON_FAILURE ERROR(ldb): uncaught exception - LDAP client internal error: NT_STATUS_LOGON_FAILURE File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line 177, in _run return self.run(*args, **kwargs) File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 528, in run transfer_dns_role(self.outf, sambaopts, credopts, role, samdb) File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 104, in transfer_dns_role credentials=creds, lp=lp) File "/usr/lib/python2.7/dist-packages/samba/samdb.py", line 64, in __init__ options=options) File "/usr/lib/python2.7/dist-packages/samba/__init__.py", line 115, in __init__ self.connect(url, flags, options) File "/usr/lib/python2.7/dist-packages/samba/samdb.py", line 79, in connect options=options) Any ideas? Thank you Lothar Schilling

1 1

OpenLDAP crashes with search from PC
by a.leurs＠consense-gmbh.de 07 Aug '20

07 Aug '20

I have a functional OpenLDAP service installed and configured on a Windows Server 2016. From another Windows Server 2016 I can get a connection to the server and can search for results. But when I start the search from a Windows 10 machine the server crashes and after that can't be accessed anymore. I don't have the last parts of the log, but I can get it. I know that are not many information, but has anybody an idea how I can find out why the OpenLDAP server is crashing when accessed from a Windows 10 machine?

2 1

LASTVALIDATIONDATE | Attribute error
by Technology Server 07 Aug '20

07 Aug '20

Dear, We tried to import the data to an existing LDAP instance but gives the same error about below attribute. str2entry: str2ad(LASTVALIDATIONDATE): attribute type undefined slapadd: could not parse entry (line=1437875) can you please let me know what is (LASTVALIDATIONDATE) attribute significance ?? We don't see any such attribute . Kindly guide us .

2 1

RE24 testing call #2 (OpenLDAP 2.4.51, LMDB 0.9.26)
by Quanah Gibson-Mount 07 Aug '20

07 Aug '20

This is the second testing call for OpenLDAP 2.4.51. Depending on the results, this may be the final testing call. Generally, get the code for RE24: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_4/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.4.51 Engineering Added slapo-ppolicy implement Netscape password policy controls (ITS#9279) Fixed libldap retry loop in ldap_int_tls_connect (ITS#8650) Fixed libldap to use getaddrinfo in ldap_pvt_get_fqdn (ITS#9287) Fixed slapd syncrepl to not delete non-replicated attrs (ITS#9227) Fixed slapd syncrepl to correctly delete entries on resync (ITS#9282) Fixed slapd syncrepl to use replace on single valued attrs (ITS#9294, ITS#9295) Fixed slapd-perl dynamic config with threaded slapd (ITS#7573) Fixed slapo-ppolicy to expose the ppolicy control (ITS#9285) Fixed slapo-ppolicy race condition for pwdFailureTime (ITS#9302) Fixed slapo-chain to check referral (ITS#9262) Contrib Fix default prefix value for pw-argon2, pw-pbkdf2 modules (ITS#9248) slapo-allowed - Fix usage of unitialized variable (ITS#9308) Documentation ldap_parse_result(3) - Document ldap_parse_intermediate (ITS#9271) LMDB 0.9.26 Engineering ITS#9278 fix robust mutex cleanup for FreeBSD --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

5 5

Removing Overlay entry from cn=config
by Stefan Kania 03 Aug '20

03 Aug '20

Hello, I start experimenting with Ansible and OpenLDAP. Now I try to set up the overlay "synprov". I noticed that everytime I start my playbook the configuration over the overlay is added to the configuration again and again, so I now have: -------------- # {0}syncprov, {1}mdb, config dn: olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpSessionlog: 300 # {1}syncprov, {1}mdb, config dn: olcOverlay={1}syncprov,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov olcSpSessionlog: 300 -------------- Then I tried to remove one of the entries with "ldapdelete" and got the following error: --------- ldapdelete -Y EXTERNAL -H ldapi:/// "olcOverlay={1}syncprov,olcDatabase={1}mdb,cn=config" SASL/EXTERNAL authentication started SASL username: gidNumber=1001+uidNumber=1001,cn=peercred,cn=external,cn=auth SASL SSF: 0 ldap_delete: Server is unwilling to perform (53) ------------------- How can I remove "dn: olcOverlay={1}syncprov,olcDatabase={1}mdb,cn=config" with ldapdelete? Or is there another way to remove the entry? Thank's for the any help Stefan

2 1

slapd daemon stop issue
by Technology Server 31 Jul '20

31 Jul '20

Dears We were trying to stop slapd daemon but after some time it is coming up on its own. We have provision and replication daemon. We tried it by killing pid also but unfortunately its coming up on its own. We have active - active set up for openldap. what could be the reason that pointing daemon to come up after shut manually. Please suggest on this ? note - We don't have any script which could bring it up when it goes down Thank you in advance for suggestions.

2 1

RE24 testing call #1 (OpenLDAP 2.4.50, LMDB 0.9.26)
by Quanah Gibson-Mount 30 Jul '20

30 Jul '20

This is the first testing call for OpenLDAP 2.4.51. Depending on the results, this may be the only testing call. Generally, get the code for RE24: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_4/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.4.51 Engineering Added slapo-ppolicy implement Netscape password policy controls (ITS#9279) Fixed libldap retry loop in ldap_int_tls_connect (ITS#8650) Fixed libldap to use getaddrinfo in ldap_pvt_get_fqdn (ITS#9287) Fixed slapd syncrepl to not delete non-replicated attrs (ITS#9227) Fixed slapd syncrepl to correctly delete entries on resync (ITS#9282) Fixed slapd-perl dynamic config with threaded slapd (ITS#7573) Fixed slapo-ppolicy to expose the ppolicy control (ITS#9285) Fixed slapo-chain to check referral (ITS#9262) Contrib Fix default prefix value for pw-argon2, pw-pbkdf2 modules (ITS#9248) Documentation ldap_parse_result(3) - Document ldap_parse_intermediate (ITS#9271) LMDB 0.9.26 Engineering ITS#9278 fix robust mutex cleanup for FreeBSD -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

7 20

LDAP error, server says:,(8) Strong(er) authentication required
by Lothar Schilling 29 Jul '20

29 Jul '20

Hi everybody, I am completely new to this group - and to OpenLDAP as well. Trying to get rid of our Windows SBS domain controller I am building a new Samba 4 server dedicated only to domain controlling, Debian 10.4, Samba 4.9.5. I'm doing this from scratch, following the textbooks. I've also setup LAM as graphical interface for administration. But once I try logging into the server's profile via that LAM interface as Administrator, I get this: "LDAP error, server says: (8) Strong(er) authentication required". (1) "ldbsearch -H ldap://ldap.[my].[domain] "cn=Administrator" -k yes": is working with the same password I would use in LAM (2) Server profile settings in LAM - TLS is deactivated - Login: Fixed list, cn=Administrator,cn=users,dc=[my],dc=[domain] (3) ldap.conf # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. BASE dc=[my],dc=[domain] URI ldap://ldap.[my].[domain] ldap://ldap-master.[my].[domain]:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never # TLS certificates (needed for GnuTLS) #TLS_CACERT /etc/ssl/certs/ca-certificates.crt What am I doing wrong? Help appreciated, thank you! Lothar Schilling

2 2

Re: RE24 testing call #1 (OpenLDAP 2.4.51, LMDB 0.9.26)
by Nick Folino 24 Jul '20

24 Jul '20

No issues on Fedora 32 - 5.7.8-200.fc32.x86_64 3 different computers with the following processors: AMD Ryzen 5 2500U with Radeon Vega Mobile Gfx Intel(R) Xeon(R) CPU E5630 @ 2.53GHz Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz On Thu, Jul 23, 2020 at 6:14 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > Subject correction -- 2.4.51. ;) > > --Quanah > > --On Thursday, July 23, 2020 4:02 PM -0700 Quanah Gibson-Mount > <quanah(a)symas.com> wrote: > > > This is the first testing call for OpenLDAP 2.4.51. Depending on the > > results, this may be the only testing call. > > > > Generally, get the code for RE24: > > > > < > https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_ > > 4/openldap-OPENLDAP_REL_ENG_2_4.tar.gz> > > > > Extract, configure, and build. > > > > Execute the test suite (via make test) after it is built. Optionally, cd > > tests && make its to run through the regression suite. > > > > Thanks! > > > > OpenLDAP 2.4.51 Engineering > > Added slapo-ppolicy implement Netscape password policy controls > > (ITS#9279) > > Fixed libldap retry loop in ldap_int_tls_connect (ITS#8650) > > Fixed libldap to use getaddrinfo in ldap_pvt_get_fqdn (ITS#9287) > > Fixed slapd syncrepl to not delete non-replicated attrs (ITS#9227) > > Fixed slapd syncrepl to correctly delete entries on resync (ITS#9282) > > Fixed slapd-perl dynamic config with threaded slapd (ITS#7573) > > Fixed slapo-ppolicy to expose the ppolicy control (ITS#9285) > > Fixed slapo-chain to check referral (ITS#9262) > > Contrib > > Fix default prefix value for pw-argon2, pw-pbkdf2 modules > > (ITS#9248) > > Documentation > > ldap_parse_result(3) - Document ldap_parse_intermediate > (ITS#9271) > > > > LMDB 0.9.26 Engineering > > ITS#9278 fix robust mutex cleanup for FreeBSD > > > > -- > > > > Quanah Gibson-Mount > > Product Architect > > Symas Corporation > > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > > <http://www.symas.com> > > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Questions regarding certain ACL constructs
by Michal Soltys 24 Jul '20

24 Jul '20

Hi, Just wanted to ask/clarify about few things related to ACLs: 1) @extensibleObject In one of the faq entries, namely: https://www.openldap.org/faq/data/cache/1140.html there is a construct that looks superfluous: access to dn.onelevel="cn=bar,ou=Stuff,dc=example,dc=com" attrs=entry,@extensibleObject Doesn't @extensibleObject include everything - entry, children and regular attributes - by default ? That's what I'd imply from the official documentation that states that not explicitly specifying attrs= is equivalent to attrs=@extensibleObject If so, then the above is equivalent to just: access to dn.onelevel="cn=bar,ou=Stuff,dc=example,dc=com" 2) entry pseudo-attribute vs writing to regular attributes This is one thing that somewhat surprises me - as the read/search access explicitly requires relevant access to entry pseudo-attribute (as per OPERATION REQUIREMENTS from slapd.access manpage). The write access on the other hand doesn't mention any requirements besides add/delete/write to the attribute itself. This actually holds true right ? 3) attr based access In one of the examples (8.4.5. Granting access to a subset of attributes), question regarding: # immediate children: only self can add/delete entries under this entry access to attrs=children by self write # entry itself: self may write, all may read access to attrs=entry by self write by * read They still do require other ACLs, as "selfs" in both cases are different, right ? E.g. if self matches parent, it won't match children being created and vice-versa (and as per the manual page - 'add' is required both for parent's 'children' as well as new entry's 'entry'). ITOW if we bind as the entity wanting to create new entry underneath, the above is not enough - and we need something more elaborate like in e.g. address book example. 4) access rights required for deeper searches suppose we have structure like: ou=A, dc=example, dc=com ou=B, ou=A, dc=example, dc=com uid=msl, ou=B, ou=A, dc=example, dc=com If we do search for uid using 'ou=A, dc=example, dc=com' as a search base (with subtree scope), what (if any) access rights do we need on 'ou=B, ou=A, dc=example, dc=com' ? 5) sets Is this feature assumed safe to use ? As - it's still formally undocumented (man pages), but there are examples on the website and syntax explanation in the faq.

1 1

Q about add accesslog entry
by Ulrich Windl 24 Jul '20

24 Jul '20

Hi! I found this accesslog entry, caused by a server-sync it seems (some strings replaced consistently for privacy): --- dn: reqStart=20200722085045.000019Z,cn=audit objectClass: auditModify structuralObjectClass: auditModify reqStart: 20200722085045.000019Z reqEnd: 20200722085045.000060Z reqType: modify reqSession: 6 reqAuthzID: cn=Admin,dc=example,dc=org reqDN: uid=username,ou=people,dc=example,dc=org reqResult: 0 reqMod: entryCSN:= 20200722082119.640611Z#000000#003#000000 reqMod: modifiersName:= cn=Admin,dc=example,dc=org reqMod: modifyTimestamp:= 20200722082119Z reqOld: entryCSN: 20200722082119.640611Z#000000#003#000000 reqOld: modifiersName: cn=Admin,dc=example,dc=org reqOld: modifyTimestamp: 20200722082119Z reqEntryUUID: 2d063f78-7ced-1032-948d-cf46530da60d entryUUID: 2cefa3e8-6044-103a-8b01-193e5edbb211 creatorsName: cn=audit createTimestamp: 20200722082119Z entryCSN: 20200722082119.640611Z#000000#003#000000 modifiersName: cn=audit modifyTimestamp: 20200722082119Z --- So if I see it correctly, only the entryUUID changed? Actually I wouldn't expect the entryUUID to change. Obviously the entry could not have been recreated after being deleted, because otherwise some other field would have changed, right? Or could this be a late consequence of improper slapadd (entryUUIDs not taken from slapcat) long time ago? Regards, Ulrich

2 2

Q: UNKNOWN attributeDescription "AUDITCONTEXT" inserted.
by Ulrich Windl 23 Jul '20

23 Jul '20

Hi! After systemd tearing down one of our LDAP servers I noticed the following message when the server was restarted: slapd[10525]: UNKNOWN attributeDescription "AUDITCONTEXT" inserted. The next line logged was: slapd[10525]: olcServerID: value #1: SID=0x002 (listener=ldap://...:389) (the server is that of SLES12 SP4, 2.4.41 from opensuse-buildservice) The server is one of three MM servers that all have the same configuration and the same version. The schema knows in olcAttributeTypes (olcSchemaConfig): ( 1.3.6.1.4.1.4203.666.11.5.1.30 NAME 'auditContext' DESC 'DN of auditContainer' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) What I'l like to know: Is there any thing I could fix in the configuration to make the message go away, or is it some software issue in slapd? Regards, Ulrich

4 10

Q: Stable output of slapcat?
by Ulrich Windl 22 Jul '20

22 Jul '20

Hi! I wonder: Is the output of slapcat expected to be stable (assuming the database did not change)? I know that LDAP attributes are considered to be sets that have no implicit ordering, but diff-wise it would be rather nice to have a stable output ordering. Here is an example of non-stable output ordering (sdiff output, only first 18 columns for confidentiality): # sdiff b0 b1 dn: olcDatabase={1 dn: olcDatabase={1 objectClass: olcDa objectClass: olcDa objectClass: olcHd objectClass: olcHd olcDatabase: {1}hd olcDatabase: {1}hd olcDbDirectory: /v olcDbDirectory: /v olcSuffix: dc=sap, olcSuffix: dc=sap, olcAccess: {0}to * < olcAccess: {1}to d < olcAccess: {2}to a < olcAccess: {3}to a < olcAccess: {4}to a < olcAccess: {5}to * < olcLimits: {0}dn.e olcLimits: {0}dn.e olcRootDN: cn=Admi olcRootDN: cn=Admi olcRootPW: {SSHA}y olcRootPW: {SSHA}y olcSecurity: ssf=1 olcSecurity: ssf=1 olcSyncrepl: {0}ri olcSyncrepl: {0}ri olcSyncrepl: {1}ri olcSyncrepl: {1}ri olcSyncrepl: {2}ri olcSyncrepl: {2}ri olcUpdateRef: ldap olcUpdateRef: ldap olcUpdateRef: ldap olcUpdateRef: ldap olcUpdateRef: ldap olcUpdateRef: ldap olcMirrorMode: TRU olcMirrorMode: TRU olcDbCacheSize: 10 olcDbCacheSize: 10 olcDbCheckpoint: 1 olcDbCheckpoint: 1 olcDbConfig: {0}se olcDbConfig: {0}se olcDbConfig: {1}se olcDbConfig: {1}se olcDbConfig: {2}se olcDbConfig: {2}se olcDbConfig: {3}se olcDbConfig: {3}se olcDbConfig: {4}se olcDbConfig: {4}se olcDbConfig: {5}se olcDbConfig: {5}se olcDbIDLcacheSize: olcDbIDLcacheSize: olcDbIndex: object olcDbIndex: object olcDbIndex: uidNum olcDbIndex: uidNum olcDbIndex: gidNum olcDbIndex: gidNum olcDbIndex: member olcDbIndex: member olcDbIndex: member olcDbIndex: member olcDbIndex: cn eq, olcDbIndex: cn eq, olcDbIndex: uid eq olcDbIndex: uid eq olcDbIndex: sn eq, olcDbIndex: sn eq, olcDbIndex: givenN olcDbIndex: givenN olcDbIndex: entryU olcDbIndex: entryU olcDbIndex: entryC olcDbIndex: entryC olcDbIndex: ipServ olcDbIndex: ipServ olcDbIndex: ipServ olcDbIndex: ipServ olcDbIndex: roleOc olcDbIndex: roleOc olcDbIndex: mail e olcDbIndex: mail e olcDbIndex: displa olcDbIndex: displa olcDbIndex: modify olcDbIndex: modify structuralObjectCl structuralObjectCl entryUUID: db3ffe4 entryUUID: db3ffe4 creatorsName: cn=c creatorsName: cn=c createTimestamp: 2 createTimestamp: 2 entryCSN: 20170706 | olcAccess: {0}to * > olcAccess: {1}to d > olcAccess: {2}to a > olcAccess: {3}to a > olcAccess: {4}to a > olcAccess: {5}to * > entryCSN: 20200114 modifiersName: cn= modifiersName: cn= modifyTimestamp: 2 modifyTimestamp: 2 So is the order of output given by some hash functions in slapcat, or is it the order in which the database returns the attributes? What would I have to do to sort the attribute types in the same order as they are listed in the schema (one possible stable output)? Regards, Ulrich

3 5

anonymize data
by Olivier - 21 Jul '20

21 Jul '20

Hi all, I have a question anonymizing data. My openldap have some confidential data inside and I would like this : if a person has a flag confidentiality set to 1 (or is in a special ou), openldap will replace or answer a different data. For example : if we request "sn" on this record , it will reply "Smith" dn: cn=Smith,ou=public,c=com confidentiality: 0 sn: Smith if we request "sn" on this record , it will reply "XXX" dn: cn=Bond,ou=public,c=com confidentiality: 1 sn: Bond I'm not sur Openldap can offer this kind of functionnality. Thanks for your help !

5 6

Re: Upgrade from 2.4.44 to 2.4.45+
by Quanah Gibson-Mount 21 Jul '20

21 Jul '20

--On Monday, July 20, 2020 11:26 PM -0700 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > What is the upgrade process from 2.4.44 to 2.4.45 or above? Are there any > breaking changes that I need to take care before and/or after upgrading? a) You need to be upgrading to 2.4.50, 2.4.45 has a few CVEs. b) If you use ppolicy, you will want to reload your database after upgrading to 2.4.50 due to a database format change for the pwdChangedTime attribute (I.e., slapcat your db, then slapadd it back in after you're done with the upgrade). Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 20 Jul '20

20 Jul '20

Hi Quanah Thank you for the response. If the consumer is several days behind and the accesslog does not have the data then fresh reload from the provider will happen automatically? Thanks Rahul On Tue, Jul 14, 2020 at 11:28 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Friday, July 10, 2020 11:04 AM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > > 1) What is the recommended value for olcSpCheckpoint? > > As per your blog value is olcSpCheckpoint: 20 10 > > I prefer to have it checkpoint fairly frequently, which is why I chose > those values. > > > 2) What is the recommended value of olcAccessLogPurge? > > As per your blog value is olcAccessLogPurge: 01+00:00 00+04:00 > > So this depends specifically on the environment in question. The more > data > retained, the further back a replica can "catch up" to the provider(s) by > using delta-syncrepl. However, the more data retained, the larger the > database will be. Whether or not one wants a replica to be able to "catch > up" to a provider if it is several days behind vs reloading it with a > fresh > copy of the db from the provider is the real question. > > Regardless of the data retention period, I always suggest a frequent purge > interval. This is because slapd essentially pauses while a purge is > ongoing. For most environments, a 4 hour purge interval is not noticable. > I've gone to as frequent as every 2 hours for extremely active sites. > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

4 5

what does "mp->mp_pgno != pgno" indicate?
by James Anderson 19 Jul '20

19 Jul '20

good afternoon; i understand from https://www.openldap.org/lists/openldap-devel/201410/msg00004.html that one should not expect this to happen, but we observed it today. mdb.c:2427: Assertion 'mp->mp_pgno != pgno' failed in mdb_page_touch() Stack trace (most recent call last): … #10 Source "../../lib/lmdbxx.h", line 597, in put<dydra::sha1, unsigned int> [0x7f29dcc68690] #9 Source "../../lib/lmdbxx.h", line 569, in put [0x7f29dcc6856d] #8 Source "/usr/local/include/lmdb++.h", line 779, in dbi_put [0x7f29dcc5ed42] #7 Source "/development/source/library/com/github/LMDB/lmdb/libraries/liblmdb/mdb.c", line 8985, in mdb_put [0x7f29dcff1b8f] #6 Source "/development/source/library/com/github/LMDB/lmdb/libraries/liblmdb/mdb.c", line 6615, in mdb_cursor_put [0x7f29dcfeef81] #5 Source "/development/source/library/com/github/LMDB/lmdb/libraries/liblmdb/mdb.c", line 6473, in mdb_cursor_touch [0x7f29dcfebd05] #4 Source "/development/source/library/com/github/LMDB/lmdb/libraries/liblmdb/mdb.c", line 5620, in mdb_page_search [0x7f29dcfea70f] #3 Source "/development/source/library/com/github/LMDB/lmdb/libraries/liblmdb/mdb.c", line 2427, in mdb_page_touch [0x7f29dcfea241] #2 Source "/development/source/library/com/github/LMDB/lmdb/libraries/liblmdb/mdb.c", line 1536, in mdb_assert_fail [0x7f29dcff3ac1] #1 Source "/build/glibc-e6zv40/glibc-2.23/stdlib/abort.c", line 89, in abort [0x7f29daaec039] #0 Source "../sysdeps/unix/sysv/linux/raise.c", line 54, in raise [0x7f29daaea438] an attempt to copy with compression fails: mdb_copy -c /srv/dydra/storage/strings.mdb/ /srv/dydra/backups/strings.bak/ mdb.c:5609: Assertion 'IS_BRANCH(mc->mc_pg[mc->mc_top])' failed in mdb_cursor_sibling() Aborted an attempt to dump the problematic sub-database fails: mdb_dump -s u32:sha1 /srv/dydra/storage/strings.mdb/ > strings-u32:sha1.txt mdb.c:5685: Assertion 'IS_LEAF(mp)' failed in mdb_cursor_next() Aborted has there been any further insight since 2014 into causes? is there an alternative to restoring the database from a backup? best regards, from berlin,

1 0

invalid credentials when userPassword hash in SSHA-512
by Jehan PROCACCIA 17 Jul '20

17 Jul '20

Hello I realized that userPassword in my openldap directory cannot be validated when hashed in SSHA-512 ldapsearch binds fails (err 49) , shibboleth SSO binding against ldap userPassword also fails I tried to check the cleartext password against the userPassword field with ApacheDirectoryStudio , here it works . I changed the password (reseeting the same cleartext one) using SSHA-256 (again in ApacheDirectoryStudio interface) , then ldapsearch bind works ! Is there a problem with SSHA-512 hashed userPassword ? Maybe something one the client or server side must be set to use SSHA-512 ? Thanks for your advices .

2 3

Documentation: mapping from slapd.conf to slapd database
by Norman Gray 16 Jul '20

16 Jul '20

Greetings. Documentation such as [1] notes that there is a one-to-one correspondence between slapd.conf directives and slapd-config database attributes. However it's not always completely clear just what the mapping is. For example, both [2] and slapo-syncprov(5) describe syncprov-checkpoint. This corresponds to the attribute olcSpCheckpoint, but I can't find where it is I learned that mapping (I probably stumbled across it via [3]), so can't point to chapter and verse in my own documentation and notes. I would have thought the documentation for the olcSyncProvConfig objectClass would explain this, but I can't find any such documentation, nor even a schema for that objectClass [4]. The problem (and my puzzlement) is not unique to the syncprov overlay. Best wishes, Norman [1] https://www.openldap.org/doc/admin24/slapdconf2.html [2] https://openldap.org/doc/admin24/overlays.html [3] https://mishikal.wordpress.com/2019/04/23/configuring-mmr-using-delta-syncr… [4] Ie, grep -i syncprov /usr/local/etc/openldap/schema/* (and similar) produces nothing. -- Norman Gray : https://nxg.me.uk

3 4

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 16 Jul '20

16 Jul '20

Thank you Quanah. This helps a lot. Let me make the changes. Thanks Rahul On Mon, Jul 6, 2020 at 5:34 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Monday, July 6, 2020 6:21 PM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > > > > > Hi Quanah > > > > > > I have some questions from update_config.ldif file > > Please don't attach screenshots of text. If you have questions, use text > email. > > In general, however: > > One database is used as the main database for the system. Lets call this > database A. > One database is used to store the accesslog data (the change deltas). Lets > call this database B. > There may be other databases on the system (such as the monitor database). > Lets call this database C. > > Both the syncprov and accesslog *overlays* must be configured on database > A > with the appropriate configuration options. > > The syncprov overlay must *also* be configured on database B with the > appropriate (but different) configuration options to indicate it's an > accesslog DB. > > In cn=config, every database has a weight that indicates the order in > which > it loads. So: > > olcDatabase={1}... is the first DB to get loaded by slapd (Ignoring {-1} > and {0} which always exist, and are the frontend and config DBs > respectively). > > olcDatabase={2}... would be the second DB to get loaded by slapd > > olcDatabase={3}... would be the third DB to get loaded by slapd > > Additionally, overlays have weights associated with them to indicate the > order in which they get loaded. So: > > olcOverlay={1}...,olcDatabase={2}... means that this overlay is the first > one that gets loaded for database #2. > > In the EXAMPLE I provided on my blog: > > olcDatabase={1} is the monitoring database (database C above) > > olcDatabase={2} is the ACCESSLOG database (database B above) > > olcDatabase={3} is the MAIN database (database A above) > > So which overlays need to apply to which databases depends ENTIRELY ON THE > ORDER in which they are defined in *YOUR* configuration. You need to make > adjustments accordingly. > > Regards, > Quanah > > > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

3 5

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 15 Jul '20

15 Jul '20

Thank you. On Wed, Jul 15, 2020 at 11:33 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Wednesday, July 15, 2020 12:31 PM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > Can you please provide the details on slapcat and import steps? > > There are man pages for both slapcat and slapadd, I suggest reading them. > > man slapcat > man slapadd > > You may also want to read the admin guide: > > > https://www.openldap.org/doc/admin24/dbtools.html#The%20{{EX:slapadd}}%20pr… > <https://www.openldap.org/doc/admin24/dbtools.html#The%20%7B%7BEX:slapadd%7D…> > > https://www.openldap.org/doc/admin24/dbtools.html#The%20{{EX:slapcat}}%20pr… > <https://www.openldap.org/doc/admin24/dbtools.html#The%20%7B%7BEX:slapcat%7D…> > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Q: Added pwdMaxRecordedFailure in pwdPolicy schema
by Ulrich Windl 15 Jul '20

15 Jul '20

Hi! It seems objectclass "pwdPolicy" (1.3.6.1.4.1.42.2.27.8.2.1) got attributetype "pwdMaxRecordedFailure" (1.3.6.1.4.1.42.2.27.8.1.30) added recently. Shouldn't the OID of the objectclass change then? Anyway, how should I upüdate the schema using cn=config? Regards, Ulrich P.S. You can find a similar question at serverfault.com

2 3

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 15 Jul '20

15 Jul '20

Hi Quanah Thank you for the response. Can you please provide the details on slapcat and import steps? Thanks Rahul On Wed, Jul 15, 2020 at 11:23 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Wednesday, July 15, 2020 10:39 AM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > > > > > Hi Quanah > > > > > > Thank you for the response. > > > > If the consumer is several days behind and the accesslog does not have > > the data then fresh reload from the provider will happen automatically? > > It will fall back to REFRESH mode which has various bugs and the resulting > DB may be deficient. If you have a consumer that is that far behind, the > only safe solution is to slapcat the provider and import on the consumer. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Ldap Entry - Invalid syntax (21)
by Koshlendra Singh 15 Jul '20

15 Jul '20

Dear Sir/Ma'am, We are using Openldap for the user authentication, While I am trying to add the new User entry using: *ldapvi -D "cn=Manager,dc=punchh,dc=com" -w abxeS3Vxxx* I am getting this - *ldap_add: Invalid syntax (21)additional info: objectClass: value #0 invalid per syntax* Here i am enclosing my ldap user entry Please give your valuable suggestions to resolve this issue. Thank you.

2 1

ldap_modify: Other (e.g., implementation specific) error (80) when adding new certificates
by Sami Ait Ali Oulahcen 14 Jul '20

14 Jul '20

Hi, I'm setting up a new instance of openldap, and I'm running into error (80) when trying to add new certificates. I've checked for the usual suspects: - certs in PEM format - file permissions along the path OK I'm using Symas' CentOS 7 repo: slapd 2.4.50 (Apr 28 2020 21:18:35) I've enabled debugging on the server (logs attached), but can't get anything out of it. Any pointers are appreciated. Regards, Sami

2 5

OpenLDAP in different directories
by Mig Ovie 08 Jul '20

08 Jul '20

Hello, I am new to OpenLDAP y would like to know whether I can install it on the /mnt. For this case, I am not allowed to install it on /etc or /usr or /var , which I believe will create many issues. Is it feasible/advisable?

3 3

Ppolicy control missing from supportedControl
by Côme Chilliet 07 Jul '20

07 Jul '20

Hello, I have ppolicy overlay correctly set up, but the ppolicy control 1.3.6.1.4.1.42.2.27.8.5.1 is not returned in supportedControl by openldap when querying the root DSE. Is this a bug or a feature? Is there something to do configuration wise to fix this? It is causing problems for PHP automated extension tests, the php-ldap module skips tests depending on whether associated controls are listed by the server or not, but ppolicy is never returned so the ppolicy test cannot run. Côme

3 4

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 06 Jul '20

06 Jul '20

Hi Quanah Just to be sure I manually removed the line and typed it back but still see the ERROR. Following line is causing the issue objectClass: olcAccessLogConfig I am attaching the ldif file for your reference. Thanks Rahul On Mon, Jul 6, 2020 at 2:40 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Monday, July 6, 2020 3:18 PM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > adding new entry "olcOverlay={1}accesslog,olcDatabase={3}mdb,cn=config" > > ldap_add: Invalid syntax (21) > > additional info: objectClass: value #1 invalid per syntax > > At a guess, you have something like a space or tab after the objectClass > value. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 3

Re: slapd 2.4.44 Performance problems
by Daniel Zuniga 06 Jul '20

06 Jul '20

Is there a reason why OpenLDAP does not seem to use more than 8 cores regardless of the number of threads it is being told to use? With 16 threads it saturates 8 cores, 16 threads and 16 cores still uses 8 cores, 32 threads and 16 cores... only 8 cores are used. On Tue, Jun 30, 2020 at 6:43 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Tuesday, June 30, 2020 10:49 PM +0000 daniel.zuniga(a)gmail.com wrote: > > > Can you offer any guidance? Thanks. > > The OpenLDAP 2.4.44 release is over 4 years old. > > You need to: > > a) Upgrade to a current release > b) Migrate off of the back-bdb/hdb backend it seems like is being used to > back-mdb. They are deprecated and have serious performance issues vs > back-mdb > (< > https://mishikal.wordpress.com/2013/05/16/openldap-a-comparison-of-back-mdb… > >). > > If you are using RHEL7 or RHEL8, my company provides a free drop-in > replacement: > > <https://repo.symas.com/sofl/> > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

5 4

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 06 Jul '20

06 Jul '20

Hi Quanah I re installed openldap with all the overlays Here is the slapd -VVV output. I do see accesslog part of static overlays. [HPE SmartFabric:root@SN2100-106 initial_config]#slapd -VVV @(#) $OpenLDAP: slapd 2.4.50 (Jul 6 2020 18:11:26) $ @SN2100-106:/root/smartfabric/open-ldap/initial_config/openldap-2.4.50/servers/slapd Included static overlays: accesslog auditlog collect constraint dds deref dyngroup dynlist memberof ppolicy pcache refint retcode rwm seqmod sssvlv syncprov translucent unique valsort Included static backends: config ldif monitor mdb relay ++++++++++++++++++++++++++++++++++++++++ How ever i still see following ERROR ldapmodify -x -D 'cn=config' -w <password> -f update_config.ldif adding new entry "olcDatabase={2}mdb,cn=config" adding new entry "olcOverlay=syncprov,olcDatabase={2}mdb,cn=config" adding new entry "olcOverlay={0}syncprov,olcDatabase={3}mdb,cn=config" *adding new entry "olcOverlay={1}accesslog,olcDatabase={3}mdb,cn=config"ldap_add: Invalid syntax (21) additional info: objectClass: value #1 invalid per syntax* here is the section which throws the ERROR dn: olcOverlay={1}accesslog,olcDatabase={3}mdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {1}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogSuccess: TRUE olcAccessLogPurge: 01+00:00 00+04:00 Thanks Rahul On Mon, Jul 6, 2020 at 1:15 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Monday, July 6, 2020 11:18 AM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > > > > > Hi Quanah > > > > > > Here is how I am building it > > > > > > 1) Download version 2.4.50 from > > https://www.openldap.org/software/download/ > > 2) Unpack the zip files > > 3) ./configure --enable-bdb=no --enable-hdb=no --enable-ipv6=yes > > I strongly advise you to really read the output of ./configure --help. It > explicitly tells you what overlays are and are not enabled by default. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 06 Jul '20

06 Jul '20

Hi Quanah Here is how I am building it 1) Download version 2.4.50 from https://www.openldap.org/software/download/ 2) Unpack the zip files 3) ./configure --enable-bdb=no --enable-hdb=no --enable-ipv6=yes 4) make depend 5) make 6) make test 7) su root -c 'make install' Let me know what I am missing so that accesslog modulegets included in slapd. Thanks Rahul On Fri, Jul 3, 2020 at 5:41 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Friday, July 3, 2020 4:09 PM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > > > > > Hi Quanah > > > > > > How do I include accesslog module in slapd ? > > Depends on how you built it, since you seem to be building your own. > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 03 Jul '20

03 Jul '20

Hi Quanah How do I include accesslog module in slapd ? Thanks Rahul On Fri, Jul 3, 2020 at 11:44 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Wednesday, July 1, 2020 9:36 PM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > > > adding new entry "olcOverlay={1}accesslog,olcDatabase={3}mdb,cn=config" > > ldap_add: Invalid syntax (21) > > additional info: objectClass: value #1 invalid per syntax > > This would indicate the accesslog module is not part of your slapd binary. > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 03 Jul '20

03 Jul '20

Hi Quanah If i comment out the module loading part then I am getting following ERROR [HPE SmartFabric:root@SN2100-106 initial_config]#ldapmodify -x -D 'cn=config' -w secret -f update_config.ldif adding new entry "olcDatabase={2}mdb,cn=config" adding new entry "olcOverlay=syncprov,olcDatabase={2}mdb,cn=config" adding new entry "olcOverlay={0}syncprov,olcDatabase={3}mdb,cn=config" adding new entry "olcOverlay={1}accesslog,olcDatabase={3}mdb,cn=config" ldap_add: Invalid syntax (21) additional info: objectClass: value #1 invalid per syntax and this ERROR is for section dn: olcOverlay={1}accesslog,olcDatabase={3}mdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {1}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogSuccess: TRUE olcAccessLogPurge: 01+00:00 00+04:00 Let me know what is wrong with this. Thanks Rahul On Wed, Jul 1, 2020 at 6:16 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Wednesday, July 1, 2020 6:43 PM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > > > > > Hi Quanah > > > > > > Here is the output of slapd -VVV command. I do see accesslog as > > static overlays. > > > > > > > > What changes i need to make in below snippet > > Moduleloading is only for dynamic modules. Since you don't have a dynamic > module, you don't need to load it. > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 03 Jul '20

03 Jul '20

Hi Quanah accesslog overlay file exists at following location /var/lib/ldap/accesslog What changes I need to make in below lines for moduleload to work dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: syncprov olcModuleLoad: accesslog Thanks Rahul On Wed, Jul 1, 2020 at 1:38 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Wednesday, July 1, 2020 11:09 AM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > I am seeing following ERROR > > I have no idea how your slapd was built, etc. But essentially the > accesslog overlay must be loaded into slapd to be of use. It looks like > at > least some of the modules in your system are compiled statically, which is > likely why you currently do not have a module{0} section for loading > modules. You'll also have to verify where on disk the accesslog overlay > exists so that the moduleload statement pulls from the right directory. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

4 5

RE: Antw: [EXT] RE: slapd 2.4.44 Performance problems
by Maucci, Cyrille 02 Jul '20

02 Jul '20

I'd probably need more details to understand what is seen, e.g. a graph over time of the CPU utilization of each core... I've been discussing with people in the past who were saying "not using" mistakingly :-) -----Original Message----- From: Ulrich Windl [mailto:Ulrich.Windl@rz.uni-regensburg.de] Sent: Thursday, July 2, 2020 7:15 AM To: daniel.zuniga(a)gmail.com; Maucci, Cyrille <cyrille.maucci(a)hpe.com>; quanah(a)symas.com Cc: openldap-technical(a)openldap.org Subject: Antw: [EXT] RE: slapd 2.4.44 Performance problems >>> "Maucci, Cyrille" <cyrille.maucci(a)hpe.com> schrieb am 01.07.2020 um >>> 18:06 in Nachricht <DF4PR8401MB0555595797F072395C494F66926C0(a)DF4PR8401MB0555.NAMPRD84.PROD.OUTLOOK. OM>: > I assume this is with back-bdb/hdb and is because Berkeley DB does not > scale beyond 8 cores. There's a difference between "not using" and "not scaling". > > From: Daniel Zuniga [mailto:daniel.zuniga@gmail.com] > Sent: Wednesday, July 1, 2020 3:43 PM > To: Quanah Gibson-Mount <quanah(a)symas.com> > Cc: openldap-technical(a)openldap.org > Subject: Re: slapd 2.4.44 Performance problems > > Is there a reason why OpenLDAP does not seem to use more than 8 cores > regardless of the number of threads it is being told to use? With 16 > threads it saturates 8 cores, 16 threads and 16 cores still uses 8 > cores, 32 threads and 16 cores... only 8 cores are used.

1 0

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 02 Jul '20

02 Jul '20

Hi Quanah Here is the output of slapd -VVV command. I do see accesslog as static overlays. What changes i need to make in below snippet *dn: cn=module{0},cn=configchangetype: modifyadd: olcModuleLoadolcModuleLoad: syncprovolcModuleLoad: accesslog* [HPE SmartFabric:root@SN2100-106 initial_config]#slapd -VVV @(#) $OpenLDAP: slapd 2.4.50 (Jul 1 2020 20:22:05) $ @SN2100-106:/root/smartfabric/open-ldap/initial_config/openldap-2.4.50/servers/slapd Included static overlays: accesslog syncprov Included static backends: config ldif monitor mdb relay On Wed, Jul 1, 2020 at 5:13 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Wednesday, July 1, 2020 4:28 PM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > > > > > Hi Quanah > > > > [Rahul] How do I verify this if modules are compiled statically? > > slapd -VV > > But if you're building OpenLDAP yourself, I suggest reading the output of > configure, which tells you how to build dynamically vs statically. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

slapd 2.4.44 Performance problems
by daniel.zuniga＠gmail.com 01 Jul '20

01 Jul '20

Hello, We are running OpenLDAP with a relatively small user base (15K users) and the server does not seem to be able to keep up with demand when there are multiple concurrent logins (20 users X 70 searches each) during user login. When users login to the server all cores in the server (8) run at 100% utilization, sometimes for as long as 20 minutes (depending on how many users are logging in concurrently). We have experimented and read and re-read the Tuning guidance but with very little success. We have tried increasing the number of available cores to slapd, but it does not use more than 8. We have also increased the number of threads from 16 to 32, but that also does not seem to have an effect nor does it seem to allow slapd to use all 16 cores (slapd seems limited to 8 cores regardless of the number of threads defined). The server has plenty of memory available and configured the db cache to use as much as in needs, but that does not seem to improve matters. Can you offer any guidance? Thanks.

3 4

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 01 Jul '20

01 Jul '20

Hi Quanah During the installation configure script was run like this ./configure --enable-bdb=no --enable-hdb=no --enable-ipv6=yes I just added following option to enable all overlays ./configure --enable-bdb=no --enable-hdb=no --enable-ipv6=yes *--enable-overlays=yes* Will this fix the problem? Thanks Rahul On Wed, Jul 1, 2020 at 1:38 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Wednesday, July 1, 2020 11:09 AM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > I am seeing following ERROR > > I have no idea how your slapd was built, etc. But essentially the > accesslog overlay must be loaded into slapd to be of use. It looks like > at > least some of the modules in your system are compiled statically, which is > likely why you currently do not have a module{0} section for loading > modules. You'll also have to verify where on disk the accesslog overlay > exists so that the moduleload statement pulls from the right directory. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 01 Jul '20

01 Jul '20

Thank you for the pointers. I will setup delta syncrepl and test to verify if I see the issue or not. Thanks Rahul On Mon, Jun 29, 2020 at 4:02 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Monday, June 29, 2020 4:20 PM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > Thank you for creating the bug. I have added myself as CC. Based on > > the configuration information I have provided, can you provide a set of > > guidelines to configure my setup to use delta-syncrepl. > > The admin guide already provides information the configuration bits > necessary to set up delta-syncrepl. Generally: > > a) You need a secondary DB to store the accesslog data from the accesslog > overlay. > > b) You need to reconfigure the olcSyncrepl config to make use of the > accesslog db. > > <https://www.openldap.org/doc/admin24/replication.html#Delta-syncrepl> > > And a blog post I wrote that gives some example configs: > > < > https://mishikal.wordpress.com/2019/04/23/configuring-mmr-using-delta-syncr… > > > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 3

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 29 Jun '20

29 Jun '20

Hi Quanah Thank you for creating the bug. I have added myself as CC. Based on the configuration information I have provided, can you provide a set of guidelines to configure my setup to use delta-syncrepl. Thanks Rahul On Mon, Jun 29, 2020 at 3:10 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Monday, June 29, 2020 3:59 PM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > > > > > Hi Quanah > > > > > > Thank you for reproducing the issue. What is the course of action > > from here on? There will be an openldap release with the fix? or a patch > > will be released? Also can you share the bug # once you raise it. How > > will I get notified once the issue is fixed and is released? > > Hi Kumar, > > As was stated before, use delta-syncrepl as it avoids these types of > issues > with standard syncrepl. I'm guessing this is another variation of issue > #8125 (<https://bugs.openldap.org/show_bug.cgi?id=8125>), although I'm > initially filing a separate bug in case it is a different problem, issue > #9282 (<https://bugs.openldap.org/show_bug.cgi?id=9282>). > > You can add yourself to the CC of the issue to track its status and > resolution. > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical