- openldap-technical - openldap.org

Q: Added pwdMaxRecordedFailure in pwdPolicy schema
by Ulrich Windl 15 Jul '20

15 Jul '20

Hi! It seems objectclass "pwdPolicy" (1.3.6.1.4.1.42.2.27.8.2.1) got attributetype "pwdMaxRecordedFailure" (1.3.6.1.4.1.42.2.27.8.1.30) added recently. Shouldn't the OID of the objectclass change then? Anyway, how should I upüdate the schema using cn=config? Regards, Ulrich P.S. You can find a similar question at serverfault.com

2 3

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 15 Jul '20

15 Jul '20

Hi Quanah Thank you for the response. Can you please provide the details on slapcat and import steps? Thanks Rahul On Wed, Jul 15, 2020 at 11:23 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Wednesday, July 15, 2020 10:39 AM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > > > > > Hi Quanah > > > > > > Thank you for the response. > > > > If the consumer is several days behind and the accesslog does not have > > the data then fresh reload from the provider will happen automatically? > > It will fall back to REFRESH mode which has various bugs and the resulting > DB may be deficient. If you have a consumer that is that far behind, the > only safe solution is to slapcat the provider and import on the consumer. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Ldap Entry - Invalid syntax (21)
by Koshlendra Singh 15 Jul '20

15 Jul '20

Dear Sir/Ma'am, We are using Openldap for the user authentication, While I am trying to add the new User entry using: *ldapvi -D "cn=Manager,dc=punchh,dc=com" -w abxeS3Vxxx* I am getting this - *ldap_add: Invalid syntax (21)additional info: objectClass: value #0 invalid per syntax* Here i am enclosing my ldap user entry Please give your valuable suggestions to resolve this issue. Thank you.

2 1

ldap_modify: Other (e.g., implementation specific) error (80) when adding new certificates
by Sami Ait Ali Oulahcen 14 Jul '20

14 Jul '20

Hi, I'm setting up a new instance of openldap, and I'm running into error (80) when trying to add new certificates. I've checked for the usual suspects: - certs in PEM format - file permissions along the path OK I'm using Symas' CentOS 7 repo: slapd 2.4.50 (Apr 28 2020 21:18:35) I've enabled debugging on the server (logs attached), but can't get anything out of it. Any pointers are appreciated. Regards, Sami

2 5

OpenLDAP in different directories
by Mig Ovie 08 Jul '20

08 Jul '20

Hello, I am new to OpenLDAP y would like to know whether I can install it on the /mnt. For this case, I am not allowed to install it on /etc or /usr or /var , which I believe will create many issues. Is it feasible/advisable?

3 3

Ppolicy control missing from supportedControl
by Côme Chilliet 07 Jul '20

07 Jul '20

Hello, I have ppolicy overlay correctly set up, but the ppolicy control 1.3.6.1.4.1.42.2.27.8.5.1 is not returned in supportedControl by openldap when querying the root DSE. Is this a bug or a feature? Is there something to do configuration wise to fix this? It is causing problems for PHP automated extension tests, the php-ldap module skips tests depending on whether associated controls are listed by the server or not, but ppolicy is never returned so the ppolicy test cannot run. Côme

3 4

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 06 Jul '20

06 Jul '20

Hi Quanah Just to be sure I manually removed the line and typed it back but still see the ERROR. Following line is causing the issue objectClass: olcAccessLogConfig I am attaching the ldif file for your reference. Thanks Rahul On Mon, Jul 6, 2020 at 2:40 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Monday, July 6, 2020 3:18 PM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > adding new entry "olcOverlay={1}accesslog,olcDatabase={3}mdb,cn=config" > > ldap_add: Invalid syntax (21) > > additional info: objectClass: value #1 invalid per syntax > > At a guess, you have something like a space or tab after the objectClass > value. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 3

Re: slapd 2.4.44 Performance problems
by Daniel Zuniga 06 Jul '20

06 Jul '20

Is there a reason why OpenLDAP does not seem to use more than 8 cores regardless of the number of threads it is being told to use? With 16 threads it saturates 8 cores, 16 threads and 16 cores still uses 8 cores, 32 threads and 16 cores... only 8 cores are used. On Tue, Jun 30, 2020 at 6:43 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Tuesday, June 30, 2020 10:49 PM +0000 daniel.zuniga(a)gmail.com wrote: > > > Can you offer any guidance? Thanks. > > The OpenLDAP 2.4.44 release is over 4 years old. > > You need to: > > a) Upgrade to a current release > b) Migrate off of the back-bdb/hdb backend it seems like is being used to > back-mdb. They are deprecated and have serious performance issues vs > back-mdb > (< > https://mishikal.wordpress.com/2013/05/16/openldap-a-comparison-of-back-mdb… > >). > > If you are using RHEL7 or RHEL8, my company provides a free drop-in > replacement: > > <https://repo.symas.com/sofl/> > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

5 4

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 06 Jul '20

06 Jul '20

Hi Quanah I re installed openldap with all the overlays Here is the slapd -VVV output. I do see accesslog part of static overlays. [HPE SmartFabric:root@SN2100-106 initial_config]#slapd -VVV @(#) $OpenLDAP: slapd 2.4.50 (Jul 6 2020 18:11:26) $ @SN2100-106:/root/smartfabric/open-ldap/initial_config/openldap-2.4.50/servers/slapd Included static overlays: accesslog auditlog collect constraint dds deref dyngroup dynlist memberof ppolicy pcache refint retcode rwm seqmod sssvlv syncprov translucent unique valsort Included static backends: config ldif monitor mdb relay ++++++++++++++++++++++++++++++++++++++++ How ever i still see following ERROR ldapmodify -x -D 'cn=config' -w <password> -f update_config.ldif adding new entry "olcDatabase={2}mdb,cn=config" adding new entry "olcOverlay=syncprov,olcDatabase={2}mdb,cn=config" adding new entry "olcOverlay={0}syncprov,olcDatabase={3}mdb,cn=config" *adding new entry "olcOverlay={1}accesslog,olcDatabase={3}mdb,cn=config"ldap_add: Invalid syntax (21) additional info: objectClass: value #1 invalid per syntax* here is the section which throws the ERROR dn: olcOverlay={1}accesslog,olcDatabase={3}mdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {1}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogSuccess: TRUE olcAccessLogPurge: 01+00:00 00+04:00 Thanks Rahul On Mon, Jul 6, 2020 at 1:15 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Monday, July 6, 2020 11:18 AM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > > > > > Hi Quanah > > > > > > Here is how I am building it > > > > > > 1) Download version 2.4.50 from > > https://www.openldap.org/software/download/ > > 2) Unpack the zip files > > 3) ./configure --enable-bdb=no --enable-hdb=no --enable-ipv6=yes > > I strongly advise you to really read the output of ./configure --help. It > explicitly tells you what overlays are and are not enabled by default. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 06 Jul '20

06 Jul '20

Hi Quanah Here is how I am building it 1) Download version 2.4.50 from https://www.openldap.org/software/download/ 2) Unpack the zip files 3) ./configure --enable-bdb=no --enable-hdb=no --enable-ipv6=yes 4) make depend 5) make 6) make test 7) su root -c 'make install' Let me know what I am missing so that accesslog modulegets included in slapd. Thanks Rahul On Fri, Jul 3, 2020 at 5:41 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Friday, July 3, 2020 4:09 PM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > > > > > Hi Quanah > > > > > > How do I include accesslog module in slapd ? > > Depends on how you built it, since you seem to be building your own. > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 03 Jul '20

03 Jul '20

Hi Quanah How do I include accesslog module in slapd ? Thanks Rahul On Fri, Jul 3, 2020 at 11:44 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Wednesday, July 1, 2020 9:36 PM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > > > adding new entry "olcOverlay={1}accesslog,olcDatabase={3}mdb,cn=config" > > ldap_add: Invalid syntax (21) > > additional info: objectClass: value #1 invalid per syntax > > This would indicate the accesslog module is not part of your slapd binary. > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 03 Jul '20

03 Jul '20

Hi Quanah If i comment out the module loading part then I am getting following ERROR [HPE SmartFabric:root@SN2100-106 initial_config]#ldapmodify -x -D 'cn=config' -w secret -f update_config.ldif adding new entry "olcDatabase={2}mdb,cn=config" adding new entry "olcOverlay=syncprov,olcDatabase={2}mdb,cn=config" adding new entry "olcOverlay={0}syncprov,olcDatabase={3}mdb,cn=config" adding new entry "olcOverlay={1}accesslog,olcDatabase={3}mdb,cn=config" ldap_add: Invalid syntax (21) additional info: objectClass: value #1 invalid per syntax and this ERROR is for section dn: olcOverlay={1}accesslog,olcDatabase={3}mdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {1}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogSuccess: TRUE olcAccessLogPurge: 01+00:00 00+04:00 Let me know what is wrong with this. Thanks Rahul On Wed, Jul 1, 2020 at 6:16 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Wednesday, July 1, 2020 6:43 PM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > > > > > Hi Quanah > > > > > > Here is the output of slapd -VVV command. I do see accesslog as > > static overlays. > > > > > > > > What changes i need to make in below snippet > > Moduleloading is only for dynamic modules. Since you don't have a dynamic > module, you don't need to load it. > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 03 Jul '20

03 Jul '20

Hi Quanah accesslog overlay file exists at following location /var/lib/ldap/accesslog What changes I need to make in below lines for moduleload to work dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: syncprov olcModuleLoad: accesslog Thanks Rahul On Wed, Jul 1, 2020 at 1:38 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Wednesday, July 1, 2020 11:09 AM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > I am seeing following ERROR > > I have no idea how your slapd was built, etc. But essentially the > accesslog overlay must be loaded into slapd to be of use. It looks like > at > least some of the modules in your system are compiled statically, which is > likely why you currently do not have a module{0} section for loading > modules. You'll also have to verify where on disk the accesslog overlay > exists so that the moduleload statement pulls from the right directory. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

4 5

RE: Antw: [EXT] RE: slapd 2.4.44 Performance problems
by Maucci, Cyrille 02 Jul '20

02 Jul '20

I'd probably need more details to understand what is seen, e.g. a graph over time of the CPU utilization of each core... I've been discussing with people in the past who were saying "not using" mistakingly :-) -----Original Message----- From: Ulrich Windl [mailto:Ulrich.Windl@rz.uni-regensburg.de] Sent: Thursday, July 2, 2020 7:15 AM To: daniel.zuniga(a)gmail.com; Maucci, Cyrille <cyrille.maucci(a)hpe.com>; quanah(a)symas.com Cc: openldap-technical(a)openldap.org Subject: Antw: [EXT] RE: slapd 2.4.44 Performance problems >>> "Maucci, Cyrille" <cyrille.maucci(a)hpe.com> schrieb am 01.07.2020 um >>> 18:06 in Nachricht <DF4PR8401MB0555595797F072395C494F66926C0(a)DF4PR8401MB0555.NAMPRD84.PROD.OUTLOOK. OM>: > I assume this is with back-bdb/hdb and is because Berkeley DB does not > scale beyond 8 cores. There's a difference between "not using" and "not scaling". > > From: Daniel Zuniga [mailto:daniel.zuniga@gmail.com] > Sent: Wednesday, July 1, 2020 3:43 PM > To: Quanah Gibson-Mount <quanah(a)symas.com> > Cc: openldap-technical(a)openldap.org > Subject: Re: slapd 2.4.44 Performance problems > > Is there a reason why OpenLDAP does not seem to use more than 8 cores > regardless of the number of threads it is being told to use? With 16 > threads it saturates 8 cores, 16 threads and 16 cores still uses 8 > cores, 32 threads and 16 cores... only 8 cores are used.

1 0

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 02 Jul '20

02 Jul '20

Hi Quanah Here is the output of slapd -VVV command. I do see accesslog as static overlays. What changes i need to make in below snippet *dn: cn=module{0},cn=configchangetype: modifyadd: olcModuleLoadolcModuleLoad: syncprovolcModuleLoad: accesslog* [HPE SmartFabric:root@SN2100-106 initial_config]#slapd -VVV @(#) $OpenLDAP: slapd 2.4.50 (Jul 1 2020 20:22:05) $ @SN2100-106:/root/smartfabric/open-ldap/initial_config/openldap-2.4.50/servers/slapd Included static overlays: accesslog syncprov Included static backends: config ldif monitor mdb relay On Wed, Jul 1, 2020 at 5:13 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Wednesday, July 1, 2020 4:28 PM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > > > > > Hi Quanah > > > > [Rahul] How do I verify this if modules are compiled statically? > > slapd -VV > > But if you're building OpenLDAP yourself, I suggest reading the output of > configure, which tells you how to build dynamically vs statically. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

slapd 2.4.44 Performance problems
by daniel.zuniga＠gmail.com 01 Jul '20

01 Jul '20

Hello, We are running OpenLDAP with a relatively small user base (15K users) and the server does not seem to be able to keep up with demand when there are multiple concurrent logins (20 users X 70 searches each) during user login. When users login to the server all cores in the server (8) run at 100% utilization, sometimes for as long as 20 minutes (depending on how many users are logging in concurrently). We have experimented and read and re-read the Tuning guidance but with very little success. We have tried increasing the number of available cores to slapd, but it does not use more than 8. We have also increased the number of threads from 16 to 32, but that also does not seem to have an effect nor does it seem to allow slapd to use all 16 cores (slapd seems limited to 8 cores regardless of the number of threads defined). The server has plenty of memory available and configured the db cache to use as much as in needs, but that does not seem to improve matters. Can you offer any guidance? Thanks.

3 4

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 01 Jul '20

01 Jul '20

Hi Quanah During the installation configure script was run like this ./configure --enable-bdb=no --enable-hdb=no --enable-ipv6=yes I just added following option to enable all overlays ./configure --enable-bdb=no --enable-hdb=no --enable-ipv6=yes *--enable-overlays=yes* Will this fix the problem? Thanks Rahul On Wed, Jul 1, 2020 at 1:38 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Wednesday, July 1, 2020 11:09 AM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > I am seeing following ERROR > > I have no idea how your slapd was built, etc. But essentially the > accesslog overlay must be loaded into slapd to be of use. It looks like > at > least some of the modules in your system are compiled statically, which is > likely why you currently do not have a module{0} section for loading > modules. You'll also have to verify where on disk the accesslog overlay > exists so that the moduleload statement pulls from the right directory. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 01 Jul '20

01 Jul '20

Thank you for the pointers. I will setup delta syncrepl and test to verify if I see the issue or not. Thanks Rahul On Mon, Jun 29, 2020 at 4:02 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Monday, June 29, 2020 4:20 PM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > Thank you for creating the bug. I have added myself as CC. Based on > > the configuration information I have provided, can you provide a set of > > guidelines to configure my setup to use delta-syncrepl. > > The admin guide already provides information the configuration bits > necessary to set up delta-syncrepl. Generally: > > a) You need a secondary DB to store the accesslog data from the accesslog > overlay. > > b) You need to reconfigure the olcSyncrepl config to make use of the > accesslog db. > > <https://www.openldap.org/doc/admin24/replication.html#Delta-syncrepl> > > And a blog post I wrote that gives some example configs: > > < > https://mishikal.wordpress.com/2019/04/23/configuring-mmr-using-delta-syncr… > > > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 3

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 29 Jun '20

29 Jun '20

Hi Quanah Thank you for creating the bug. I have added myself as CC. Based on the configuration information I have provided, can you provide a set of guidelines to configure my setup to use delta-syncrepl. Thanks Rahul On Mon, Jun 29, 2020 at 3:10 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Monday, June 29, 2020 3:59 PM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > > > > > Hi Quanah > > > > > > Thank you for reproducing the issue. What is the course of action > > from here on? There will be an openldap release with the fix? or a patch > > will be released? Also can you share the bug # once you raise it. How > > will I get notified once the issue is fixed and is released? > > Hi Kumar, > > As was stated before, use delta-syncrepl as it avoids these types of > issues > with standard syncrepl. I'm guessing this is another variation of issue > #8125 (<https://bugs.openldap.org/show_bug.cgi?id=8125>), although I'm > initially filing a separate bug in case it is a different problem, issue > #9282 (<https://bugs.openldap.org/show_bug.cgi?id=9282>). > > You can add yourself to the CC of the issue to track its status and > resolution. > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 29 Jun '20

29 Jun '20

Hi Quanah Thank you for reproducing the issue. What is the course of action from here on? There will be an openldap release with the fix? or a patch will be released? Also can you share the bug # once you raise it. How will I get notified once the issue is fixed and is released? Thanks Rahul On Mon, Jun 29, 2020 at 2:55 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Tuesday, June 23, 2020 5:04 PM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > Hi Quanah > > Hi Kumar, > > I was able to reproduce the issue, thanks for the report. I'll file a bug > for it. > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 29 Jun '20

29 Jun '20

Hi Quanah Please find my answers inline a) Both servers have no DB, but are using these configs [Rahul] Both servers are started with an empty database. Both servers are in Provider and consumer mode. Our application is running on both servers as well. To start with our application is active on Server A, which means data will be written to server A database.and is synced/replicated to server B b) DB is added to server A and replicated to server B [Rahul] Yes since server A has our application in active mode hence data is written on server A and replicated to server B. c) server A is stopped [Rahul] yes we reboot the server A. d) You say "data is removed", I'm not sure what this means. A single entry? Multiple entries? The entire database? [Rahul] Now our application is active on Server B. Using server B removed "a Single Entry" which was removed from server B database as well. e) S1 is restarted, and the deleted data is replicated back to both nodes. [Rahul] Yes deleted data is replicated back to both nodes. when S1 is restarted slapd is configured in provider/consumer mode but our application is still active on server B which means writes will only happen at server B and should be synced to server A. Thank you for all the help so far. I have no intention of interrupting your work. Please look at my issue based on your convenience. Let me know if you have any other questions. Thanks Rahul On Tue, Jun 23, 2020 at 3:43 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Tuesday, June 23, 2020 1:47 PM -0400 kumar rahul > <rahul2002mit(a)gmail.com> wrote: > > > Both the servers are set up as master as well as consumer so that > > sync works in both directions. So > > the sync setup is like "A -> B", > > and when A fails B is updated and the expectation is that "B -> A" should > > work because a multi master setup is already in place. Let me know based > > on the attached configuration files if my assumption is correct or not. > > > > > > Also Add data works when A fails and B is updated then sync "B -> A"works > > fine. > > > > After Delete data sync does not work when A fails and data is deleted > > from B. Once A comes back both databases have data which was deleted on > B. > > Hi, > > I'll see if I can reproduce your issue with the configs provided (Assuming > they look correct after I finish reviewing them in full), but I want to > confirm the exact steps: > > a) Both servers have no DB, but are using these configs > > b) DB is added to server A and replicated to server B > > c) server A is stopped > > d) You say "data is removed", I'm not sure what this means. A single > entry? Multiple entries? The entire database? > > e) S1 is restarted, and the deleted data is replicated back to both nodes. > > Note that I do have a paid job that keeps me busy, so this is a best > effort > when I have time available to investigate. > > Thanks, > Quanah > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

LMDB transaction flags
by Stefano Cossu 29 Jun '20

29 Jun '20

Hello, I'd like to be able to know if a LMDB transaction is active, valid, dirty, read-only, etc. From the documentation I read that such information is in mt_flags of the mdb_txn structure, which is opaque. I don't see any function exposing mt_flags. Is there any other way to read that information?

2 4

[Question]: Looking for updated ppolicy in v2.4.50
by Dave Macias 29 Jun '20

29 Jun '20

Hello, Using openldap v2.4.50 and noticed that there were some updates <https://github.com/openldap/openldap/commit/4bc54d104a9563d35f3d5fc2e69fe7a…> which were part of the 2.4.50 release. I installed openldap but cannot find those new attributes (pwdMaxLength, pwdStartTime, etc) > grep pwdMaxL /etc/openldap/schema/* > grep pwdStar /etc/openldap/schema/* Maybe I am missing something. Could someone please point me in the right direction? Thank you, Dave

2 1

Re: [Question]: centos8 install - looking for migrationtools package
by Dave Macias 29 Jun '20

29 Jun '20

Thank you for the reply! Decided to use the centos7 versions. They worked like a charm! Regards, Dave On Fri, Jun 26, 2020 at 2:56 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Thursday, June 25, 2020 1:01 PM -0400 Dave Macias <davama(a)gmail.com> > wrote: > > > > > Hello, > > > > > > Our production env is centos7 and we were testing to see how it would > > work on centos8. > > > > > > There were no issues using the symas pkgs. Thank you for providing them! > > > > > > I was wondering if someone knew where I could find the migrationtools for > > centos8? > > I think since rhel stopped supporting openldap-servers, it would make > > sense that the migrationtools package would disappear too. > > > > > > Perhaps this is not the right place to ask, but any input is much > > appreciated. > > What you would likely need to do is look at the Fedora git repository for > the migrationtools package and port it for CentOS8 and then build it > yourself. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

OpenLDAP results limited via SSL?
by a.leurs＠consense-gmbh.de 27 Jun '20

27 Jun '20

Hello, I have installed OpenLDAP on my Windows machine (Windows 10) and configured a connection to our company LDAP. The connection is via LDAPS. Here is my slapd.conf #LDAP Backend configuration file # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. ucdata-path ./ucdata include ./schema/core.schema include ./schema/cosine.schema include ./schema/nis.schema include ./schema/inetorgperson.schema pidfile ./run/slapd.pid argsfile ./run/slapd.args # Full log level loglevel 32768 16384 2048 1024 512 256 128 64 32 16 8 4 2 1 sizelimit 10000 timelimit 10000 # Enable TLS if port is defined for ldaps (to openldap) TLSVerifyClient never #TLSCipherSuite ECDHE-RSA-AES256-SHA384:AES256-SHA256:!RC4:HIGH:!MD5:!aNULL:!EDH:!EXP:!SSLV2:!eNULL TLSCipherSuite HIGH:MEDIUM:-SSLv2:-SSLv3 TLSProtocolMin 3.3 TLSCertificateFile ./secure/certs/maxcrc.cert.pem TLSCertificateKeyFile ./secure/certs/maxcrc.key.pem TLSCACertificateFile ./secure/certs/maxcrc.cert.pem # Configuration for Connection to company.local database meta suffix "DC=company,DC=local" rootdn "DC=company,DC=local" rebind-as-user yes uri ldaps://DC001.company.local:636/dc=company,DC=local lastmod off chase-referrals no idassert-bind bindmethod=simple binddn="cn=CN=User Name,OU=Users,OU=Orga,DC=company,DC=local" credentials=XXX tls_reqcert=never tls_cacert=./secure/certs/company-ca.pem tls ldaps tls_reqcert=allow tls_cacert=./secure/certs/company-ca.pem overlay rwm rwm-map attribute uid samaccountname rwm-map attribute member memberOf rwm-map attribute sn sn rwm-map attribute givenname givenname rwm-map attribute intials initials When I connect to the OpenLDAP server with Softerra LDAP-Browser and search the directory I don't get any results, when the results are more than 65 entries. When I use paging in the search (to restrict the results to only 65 results) then it works. On a machine of a colleague the limit is 70 results. We didn't find any information where an restriction on the LDAP server could be. Any idea why the results are limited? When I do a connection without SSL it works fine.

3 4

[Question]: centos8 install - looking for migrationtools package
by Dave Macias 26 Jun '20

26 Jun '20

Hello, Our production env is centos7 and we were testing to see how it would work on centos8. There were no issues using the symas pkgs. Thank you for providing them! I was wondering if someone knew where I could find the migrationtools for centos8? I think since rhel stopped supporting openldap-servers, it would make sense that the migrationtools package would disappear too. Perhaps this is not the right place to ask, but any input is much appreciated. Thank you, Dave

2 1

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 23 Jun '20

23 Jun '20

Hi Quanah Both the servers are set up as master as well as consumer so that sync works in both directions. So the sync setup is like "A -> B", and when A fails B is updated and the expectation is that "B -> A" should work because a multi master setup is already in place. Let me know based on the attached configuration files if my assumption is correct or not. Also Add data works when A fails and B is updated then sync "B -> A"works fine. After Delete data sync does not work when A fails and data is deleted from B. Once A comes back both databases have data which was deleted on B. Thanks Rahul On Tue, Jun 23, 2020 at 8:11 AM Ulrich Windl < Ulrich.Windl(a)rz.uni-regensburg.de> wrote: > >>> Quanah Gibson-Mount <quanah(a)symas.com> schrieb am 22.06.2020 um 18:09 > in > Nachricht > <13855_1592842197_5EF0D7D5_13855_226_1_A497B27F9A5328340A4CDBAC@ > [192.168.1.144]> > > > > > > ‑‑On Monday, June 22, 2020 3:08 PM +0000 Kumar Rahul > > <rahul2002mit(a)gmail.com> wrote: > > > >> Hi Quanah > >> > >> Thank you for all the help so far. I am still seeing the original > >> issue reported. Let me know if you need fresh set of configuration > >> information. > > > > I've told you repeatedly what is necessary, you haven't provided it. > > > > To re‑iterate: > > > > Full configuration of both servers, not config snippets or LDAP modify > > change code. > > Actually (if I read the description correctly the sync setup is like "A -> > B", > and when A fails B is updated and expectation is that "B -> A" will work > automagically (which is not true IMHO). Then multi-master setup is needed. > > > > > Regards, > > Quanah > > > > > > > > ‑‑ > > > > Quanah Gibson‑Mount > > Product Architect > > Symas Corporation > > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > > <http://www.symas.com> > > > >

2 1

Re: [EXT] Re: syncrepl does not work as expected
by kumar rahul 23 Jun '20

23 Jun '20

Hi Ulrich Both the servers are set up as master as well as consumer so that sync works in both directions. So the sync setup is like "A -> B", and when A fails B is updated and the expectation is that "B -> A" should work because a multi master setup is already in place. Let me know based on the attached configuration files if my assumption is correct or not. Also Add data works when A fails and B is updated then sync "B -> A"works fine. After Delete data sync does not work when A fails and data is deleted from B. Once A comes back both databases have data which was deleted on B. Thanks Rahul On Tue, Jun 23, 2020 at 8:11 AM Ulrich Windl < Ulrich.Windl(a)rz.uni-regensburg.de> wrote: > >>> Quanah Gibson-Mount <quanah(a)symas.com> schrieb am 22.06.2020 um 18:09 > in > Nachricht > <13855_1592842197_5EF0D7D5_13855_226_1_A497B27F9A5328340A4CDBAC@ > [192.168.1.144]> > > > > > > ‑‑On Monday, June 22, 2020 3:08 PM +0000 Kumar Rahul > > <rahul2002mit(a)gmail.com> wrote: > > > >> Hi Quanah > >> > >> Thank you for all the help so far. I am still seeing the original > >> issue reported. Let me know if you need fresh set of configuration > >> information. > > > > I've told you repeatedly what is necessary, you haven't provided it. > > > > To re‑iterate: > > > > Full configuration of both servers, not config snippets or LDAP modify > > change code. > > Actually (if I read the description correctly the sync setup is like "A -> > B", > and when A fails B is updated and expectation is that "B -> A" will work > automagically (which is not true IMHO). Then multi-master setup is needed. > > > > > Regards, > > Quanah > > > > > > > > ‑‑ > > > > Quanah Gibson‑Mount > > Product Architect > > Symas Corporation > > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > > <http://www.symas.com> > > > >

1 0

syncrepl does not work as expected
by rahul2002mit＠gmail.com 22 Jun '20

22 Jun '20

Hi I am using LDAP protocol as front end and Berkeley DB as back end. I am observing a strange syncrepl issue type=refreshAndPersist is being used $OpenLDAP: slapd 2.4.44 OS: RHEL7U6 I have 2 server setup say S1 and S2. S1 is in provider and S2 is in consumer mode. Added data D1 in database and that was synced with S2 database. Now I killed slapd process on server S1. At this point server S2 assumes provider role. Now I removed data D1 from database using server S2. Once deletion is complete validated that data was removed from server S2 database. Now i brought S1 slapd service back up and started the application which starts syncrepl. Here is what i see both server S1 and S2 has data D1 which was actually deleted. Expected behavior: Both server should sync properly and data D1 which was deleted using Server S2 should not be present in the database after sync. Request you guys to help. Thanks Rahul

5 45

Privileges for slapd service
by darkdragon 19 Jun '20

19 Jun '20

Dockerfile: ```Dockerfile FROM debian:buster ENV container docker # systemd RUN apt-get update && apt-get install -y \ systemd systemd-sysv && \ apt-get clean && \ rm -rf /var/lib/apt/lists/* RUN systemctl disable systemd-resolved.service RUN systemctl disable systemd-hostnamed.service STOPSIGNAL SIGRTMIN+3 CMD [ "/sbin/init" ] RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \ slapd && \ apt-get clean && rm -rf /var/lib/apt/lists/* RUN systemctl enable slapd.service # Allow restart of slapd after dpkg-reconfigure (docker forbids this by default) RUN bash -c "install -m755 <(printf '#!/bin/sh\nexit 0') /usr/sbin/policy-rc.d" ``` Build command: ```sh docker build -t tmp . ``` Run command: ```sh docker run \ --name=tmp \ -it \ --tmpfs /run \ --tmpfs /run/lock \ --tmpfs /tmp \ -v /sys/fs/cgroup:/sys/fs/cgroup:ro \ --rm \ tmp ``` Slapd restart (run within container): ```sh service slapd restart ``` Log (journalctl -u slapd): Jun 18 07:14:25 81bb7d58af2b systemd[1]: Starting LSB: OpenLDAP standalone server (Lightweight Directory Access Protocol)... Jun 18 07:14:25 81bb7d58af2b slapd[39]: @(#) $OpenLDAP: slapd (Apr 20 2020 18:19:54) $ Debian OpenLDAP Maintainers <pkg-openldap-devel(a)lists.alioth.debian.org> Jun 18 07:14:25 81bb7d58af2b slapd[40]: slapd starting Jun 18 07:14:25 81bb7d58af2b slapd[27]: Starting OpenLDAP: slapd. Jun 18 07:14:25 81bb7d58af2b systemd[1]: Started LSB: OpenLDAP standalone server (Lightweight Directory Access Protocol). Jun 18 07:14:35 81bb7d58af2b systemd[1]: Stopping LSB: OpenLDAP standalone server (Lightweight Directory Access Protocol)... Jun 18 07:14:35 81bb7d58af2b slapd[72]: Stopping OpenLDAP: slapd. Jun 18 07:14:35 81bb7d58af2b systemd[1]: slapd.service: Succeeded. Jun 18 07:14:35 81bb7d58af2b systemd[1]: Stopped LSB: OpenLDAP standalone server (Lightweight Directory Access Protocol). Jun 18 07:14:40 81bb7d58af2b systemd[1]: slapd.service: Found left-over process 40 (slapd) in control group while starting unit. Ignoring. Jun 18 07:14:40 81bb7d58af2b systemd[1]: This usually indicates unclean termination of a previous run, or service implementation deficiencies. Jun 18 07:14:40 81bb7d58af2b systemd[1]: Starting LSB: OpenLDAP standalone server (Lightweight Directory Access Protocol)... Jun 18 07:14:40 81bb7d58af2b slapd[99]: Starting OpenLDAP: slapd failed! Jun 18 07:14:40 81bb7d58af2b systemd[1]: slapd.service: Control process exited, code=exited, status=1/FAILURE Jun 18 07:14:40 81bb7d58af2b systemd[1]: slapd.service: Failed with result 'exit-code'. Jun 18 07:14:40 81bb7d58af2b systemd[1]: Failed to start LSB: OpenLDAP standalone server (Lightweight Directory Access Protocol). --- The problem seems to be an unclean stop (left-over process) which still occupies the port. Which capabilities [1] / seccomp [2] is needed by slapd? [1]: https://linux.die.net/man/7/capabilities [2]: https://docs-stage.docker.com/engine/security/seccomp/ --- My goal is to set the domain to "thisbox". Running the following code (within container): ```sh cat <<EOF >/tmp/slapd Name: slapd/domain Template: slapd/domain Value: thisbox Owners: slapd EOF DEBIAN_FRONTEND=noninteractive DEBCONF_DB_OVERRIDE=/tmp/slapd dpkg-reconfigure slapd ``` Log (journalctl -u slapd): -- Logs begin at Thu 2020-06-18 07:43:44 UTC, end at Thu 2020-06-18 07:44:57 UTC. -- Jun 18 07:43:44 fe1ddc01fdaf systemd[1]: Starting LSB: OpenLDAP standalone server (Lightweight Directory Access Protocol)... Jun 18 07:43:44 fe1ddc01fdaf slapd[38]: @(#) $OpenLDAP: slapd (Apr 20 2020 18:19:54) $ Debian OpenLDAP Maintainers <pkg-openldap-devel(a)lists.alioth.debian.org> Jun 18 07:43:44 fe1ddc01fdaf slapd[39]: slapd starting Jun 18 07:43:44 fe1ddc01fdaf slapd[28]: Starting OpenLDAP: slapd. Jun 18 07:43:44 fe1ddc01fdaf systemd[1]: Started LSB: OpenLDAP standalone server (Lightweight Directory Access Protocol). Jun 18 07:43:48 fe1ddc01fdaf systemd[1]: Stopping LSB: OpenLDAP standalone server (Lightweight Directory Access Protocol)... Jun 18 07:43:48 fe1ddc01fdaf slapd[160]: Stopping OpenLDAP: slapd. Jun 18 07:43:48 fe1ddc01fdaf systemd[1]: slapd.service: Succeeded. Jun 18 07:43:48 fe1ddc01fdaf systemd[1]: Stopped LSB: OpenLDAP standalone server (Lightweight Directory Access Protocol). Jun 18 07:43:48 fe1ddc01fdaf systemd[1]: Starting LSB: OpenLDAP standalone server (Lightweight Directory Access Protocol)... Jun 18 07:43:48 fe1ddc01fdaf slapd[170]: @(#) $OpenLDAP: slapd (Apr 20 2020 18:19:54) $ Debian OpenLDAP Maintainers <pkg-openldap-devel(a)lists.alioth.debian.org> Jun 18 07:43:48 fe1ddc01fdaf slapd[170]: daemon: bind(8) failed errno=98 (Address already in use) Jun 18 07:43:48 fe1ddc01fdaf slapd[170]: daemon: bind(8) failed errno=98 (Address already in use) Jun 18 07:43:48 fe1ddc01fdaf slapd[170]: slapd stopped. Jun 18 07:43:48 fe1ddc01fdaf slapd[170]: connections_destroy: nothing to destroy. Jun 18 07:43:48 fe1ddc01fdaf slapd[165]: Starting OpenLDAP: slapd failed! Jun 18 07:43:48 fe1ddc01fdaf systemd[1]: slapd.service: Control process exited, code=exited, status=1/FAILURE Jun 18 07:43:48 fe1ddc01fdaf systemd[1]: slapd.service: Failed with result 'exit-code'. Jun 18 07:43:48 fe1ddc01fdaf systemd[1]: Failed to start LSB: OpenLDAP standalone server (Lightweight Directory Access Protocol). So the problem indicates that the address is already in use. --- Setting the configuration within Dockerfile (no need to restart in container): ```Dockerfile RUN echo "" >> /tmp/slapd && \ echo "Name: slapd/domain" >> /tmp/slapd && \ echo "Template: slapd/domain" >> /tmp/slapd && \ echo "Value: thisbox" >> /tmp/slapd && \ echo "Owners: slapd" >> /tmp/slapd && \ echo "" >> /tmp/slapd && \ DEBIAN_FRONTEND=noninteractive \ DEBCONF_DB_OVERRIDE=/tmp/slapd \ dpkg-reconfigure slapd ``` doesn't throw any error, but doesn't seem to work either. ```sh ldapadd -Q -Y EXTERNAL -H ldapi:/// ``` logs to stdout: ``` adding new entry "ou=users,dc=thisbox" ldap_add: Server is unwilling to perform (53) additional info: no global superior knowledge ``` So for some reason the setup on container creation doesn't seem to be used. --- I am new to LDAP, so I am apologizing if I am using something completely wrongly. Just trying to fix https://salsa.debian.org/freedombox-team/freedombox/-/issues/1880. Any help appreciated!

2 2

ldapsearch filter behaviour
by mradu＠live.com 16 Jun '20

16 Jun '20

Hi, I have 2 LDAP servers. The old one is running openldap2-2.3.32 and the new one is running openldap2-2.4.41. They both have identical configuration and data. Running the following ldapsearch command against the 2 servers only yields results on the old openldap 2.3.32: ldapsearch -H ldap://server -b 'dc=mycorp,dc=com' -D 'cn=Administrator,dc=mycorp,dc=com' -w 'passwd' '(cn=*)' cn Aparently every time I am using a filter having the "*" wildcard the new openldap fails to give back any results. Any ideea what is going on? Thanks

2 1

Re: Info needed on OpenLDAP support / compliance on FIPS 140.2
by Vijay Kumar 16 Jun '20

16 Jun '20

Thank you Quanah, As i mentioned, we are using OpenLDAP 2.4.48 version from https://www.openldap.org/ which internally uses OpenSSL I would like to know, is this version of OpenLDAP with OpennSSL does FIPS compliant.? Regards, Vijay Kumar On Mon, Jun 15, 2020 at 10:22 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Monday, June 15, 2020 5:03 PM +0530 Vijay Kumar > <pasumarthivijaykumar(a)gmail.com> wrote: > > > > > Hi Team, > > > > > > We are using the version 2.4.48 OpenLDAP, we would like to know which > > versions of OpenLDAP which used OpenSSL are compliant towards FIPS 140.2 > > standards.? > > Hello, > > Do *NOT* post to multiple lists. > > The FIPS question is not really an OpenLDAP question at all. Either the > build of OpenLDAP you are using is linked to a FIPS version of OpenSSL or > it isn't. You'd need to find out from whomever provided your OpenLDAP > build (and that's assuming it's linked to OpenSSL) if that OpenSSL build > is > FIPS enabled. > > Reards, > Quaanh > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > -- Thanks & Regards, Vijay Kumar *+91-94944 44009*

5 4

Re: Re: Info needed on OpenLDAP support / compliance on FIPS 140.2
by Vijay Kumar 16 Jun '20

16 Jun '20

Thanks a lot Philip Guenther Absolute needful Info to all. Regards, Vijay Kumar On Tue, Jun 16, 2020 at 1:43 PM Marc Roos <M.Roos(a)f1-outsourcing.eu> wrote: > > Thanks for this clear insight! > > > -----Original Message----- > To: Scott Classen > Cc: Vijay Kumar; openldap-technical(a)openldap.org > Subject: *****SPAM***** Re: Info needed on OpenLDAP support / compliance > on FIPS 140.2 > > On Mon, 15 Jun 2020, Scott Classen wrote: > > Did you build the OpenLDAP binary from source or are you using a > > binary distribution from somewhere? Like Quanah already stated, you > > need to determine if the version of OpenSSL you linked against is FIPS > > > compliant. The FIPS designation has nothing to do with OpenLDAP per > se. > > > > e.g. on my CentOS distro I can type > > > > # openssl version > > OpenSSL 1.0.2k-fips 26 Jan 2017 > > > > And it lets me know that OpenSSL is FIPS compliment. Then if I build > > OpenLDAP using the openssl libraries provided with my distro then I’m > > > assuming it would then inherit some of this FIP-ness. > > Simply _using_ that library is not nearly enough to pass any sort of > compliance check. Here's a session using a similar library (CentOS > 7.7.1908) with anonymous RC4-MD5, an absolutely non-FIPS-compliant > cipher > suite: > > $ openssl version > OpenSSL 1.0.2k-fips 26 Jan 2017 > $ echo foo | openssl s_server -cipher ADH-RC4-MD5 -nocert -quiet & [1] > 31787 $ openssl s_client -connect localhost:4433 -cipher aNULL -quiet > foo read:errno=0 $ fg echo foo | openssl s_server -cipher ADH-RC4-MD5 > -nocert -quiet ^C $ > > > First, you have to actually tell the library to go into FIPS mode. The > CLI 'openssl' tool will do that when the OPENSSL_FIPS environment > variable is set and I seem to recall that the system openssl libs on > RedHat systems (don't remember if it carried over to CentOS) would do so > if a kernel parameter was set, but in general applications using libssl > and libcrypto have to use the FIPS_mode_set() API to turn on FIPS mode > themselves. > Last I checked, OpenLDAP had no calls to FIPS_mode_set(), so unless your > system libcrypto has something external to force FIPS mode *and your're > using it*, OpenLDAP will _not_ be using the library in FIPS mode. > > > Furthermore, is that build of openssl still covered by a valid FIPS > certificate? "It's a build of sources for which some build has had a > FIPS certificate issued" is cute verbiage and there are many people that > only care about that: verbiage so they can check a unclearly specified > box on their documents. Not a bad option if that's all your customers > expect and all you sell/promise, given that FIPS mode is not strictly > beneficial with the difficulty it creates for fixing bugs in crypto > implementations, including--historically--in openssl's code base. > > While some customers will find that sufficient to check a box on their > documents, it ain't going to make real FIPS compliance people (U.S. > government agencies) blink before ignoring it. If you're going to have > a compliance audit from such a group, with scheduled followups and > 30/60/90 day remediation requirements, then no, stock openldap on stock > centos, for example, will not get you there. > > > Philip Guenther > > > -- Thanks & Regards, Vijay Kumar *+91-94944 44009*

1 0

Re: syncrepl does not work as expected
by Giuseppe De Marco 15 Jun '20

15 Jun '20

Ciao kumar, A fully working example, configurable with ansible with delta syncrepl ready to go, for studies and prototyping, Is here: https://github.com/peppelinux/ansible-slapd-eduperson2016 Run as It come in a container, for a replica node see delta repl readme, Have fun and don't give up Il lun 15 giu 2020, 21:29 Quanah Gibson-Mount <quanah(a)symas.com> ha scritto: > > > --On Monday, June 15, 2020 8:05 PM +0000 Kumar Rahul > <rahul2002mit(a)gmail.com> wrote: > > > dn: olcDatabase={1}mdb,cn=config > > objectClass: olcMdbConfig > > olcDatabase: {1}mdb > > olcDbDirectory: /usr/local/var/openldap-data/data_db > > olcSuffix: dc=smartsan > > olcRootDN: cn=info,dc=data > > olcAccess: {0}to * by dn.base="cn=info,dc=data" read by * break > > Assuming the above is your actual configuration, then.. > > Your sync replication configuration uses: > > binddn="cn=admin,dc=smartsan" > > But this identity is given no access to your database, as it's not the > rootDN, and there are no ACLs providing access to it. > > As an aside, your ACL {0} makes no sense since you have cn=info,cn=data as > your rootdn, and rootdn's are not subject to access control. The only > other thing it does is break to the default ACL of to * by * none. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > -- ------------------------------------------------------------------------------------------------------------------ Il banner è generato automaticamente dal servizio di posta elettronica dell'Università della Calabria <https://www.unical.it/portale/portaltemplates/view/view.cfm?100061>

1 0

OpenLDAP with SSL connection and search only with wildcard
by a.leurs＠consense-gmbh.de 15 Jun '20

15 Jun '20

Hello, I have successfully managed to create my SSL-Connection to the OpenLDAP and from the OpenLDAP the two different Active Directorys. But now when I perform a search with only a wildcard (e.g. (sn=*)), I don't get any results. A search with the filter (sn=l*) works fine. I get all users wich lastname starts with the letter 'l'. When I switch back to LDAP instead of LDAPS it works fine. Here is my slapd.conf: #LDAP Backend configuration file # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. ucdata-path ./ucdata include ./schema/core.schema include ./schema/cosine.schema include ./schema/nis.schema include ./schema/inetorgperson.schema pidfile ./run/slapd.pid argsfile ./run/slapd.args # Full log level loglevel 32768 16384 2048 1024 512 256 128 64 32 16 8 4 2 1 sizelimit unlimited timelimit unlimited # Enable TLS if port is defined for ldaps (to openldap) TLSVerifyClient never TLSCipherSuite HIGH:MEDIUM:-SSLv2:-SSLv3 TLSProtocolMin 3.3 TLSCertificateFile ./secure/certs/maxcrc.cert.pem TLSCertificateKeyFile ./secure/certs/maxcrc.key.pem TLSCACertificateFile ./secure/certs/maxcrc.cert.pem # Configuration for Connection to example.com database meta suffix "DC=example,DC=com" rootdn "DC=example,DC=com" rebind-as-user yes uri ldaps://example.com:636/dc=example,DC=com lastmod off chase-referrals no idassert-bind bindmethod=simple binddn="cn=CN=username,OU=Users,OU=Orga,DC=example,DC=com" credentials="XXXX" tls_reqcert=never tls_cacert=./secure/certs/example.pem tls ldaps tls_reqcert=allow tls_cacert=./secure/certs/example.pem # Configuration for Connection to Test-LDAP uri ldap://ldap.andrew.cmu.edu/dc=test,dc=exapmle,dc=com suffixmassage "dc=test,dc=example,dc=com" "dc=edu,dc=meta,dc=com" overlay rwm rwm-map attribute uid samaccountname rwm-map attribute member memberOf rwm-map objectclass inetOrgPerson user

3 3

Info needed on OpenLDAP support / compliance on FIPS 140.2
by Vijay Kumar 15 Jun '20

15 Jun '20

Hi Team, We are using the version 2.4.48 OpenLDAP, we would like to know which versions of OpenLDAP which used OpenSSL are compliant towards FIPS 140.2 standards.? Please let us know the details. Thank you. -- Thanks & Regards, Vijay Kumar *+91-94944 44009*

2 1

Best practices in storing user device data
by Nick Milas 13 Jun '20

13 Jun '20

Hello everyone, In our (non-profit, research) organization we are already using OpenLDAP for many years, storing people data and dns records (LDAP-based DNS server). We are now looking into how we could organize our LDAP DIT in order to store device data (descriptions, MAC addresses, IP Addresses). The idea is to be able to use the DIT for combined and/or independent user- and device- based authentication throughout the network (e.g. using TACACS, Radius pulling data from LDAP DIT or elsewhere). Currently we are storing data about devices (IP and MAC) Addresses using phpIPAM and NetDisco open source software, so data is stored in relational databases (postgresql on NetDisco, MySQL on phpIPAM), yet network-related data is not directly (i.e. integrated in db schemas) associated to users (except in descriptions). In phpIPAM we are organizing our IP Spaces (public and private). NetDisco uses SNMP to scan the network and automatically associate end-devices ("nodes") to switches ("devices") and MAC addresses to IP addresses. We are currently investigating whether we should: 1. Store device data in the DIT as part of user records. Thus, each user entry would also include info about the devices the user is responsible for, most importantly IP Addresses assigned to them and MAC addresses. Is this approach considered sane? If so, which Object Class(es) would serve this need? 2. Store data in a separate branch, for example: dn: cn=devicexxx,ou=Nodes,dc=example,dc=com objectClass: device objectClass: ieee802Device objectClass: radiusprofile objectClass: simpleSecurityObject objectClass: top cn: devicexxx description: Main Server at Net Lab l: Main Campus macAddress: 00:24:8c:3c:xx:xx ou: tech owner: cn=TechAdmins,ou=Groups,dc=example,dc=com radiusArapSecurity: 195.xxx.xxx.1 radiusArapZoneAccess: 255.255.255.128 radiusFramedIPAddress: 195.xxx.xxx.63 radiusHint: 50004 radiusNASIpAddress: 195.xxx.xxx.125 radiusTerminationAction: 33 radiusTunnelMediumType: IEEE-802 radiusTunnelPrivateGroupId: 1 radiusTunnelType: VLAN userPassword:: **************** We have successfully tried this approach using FreeRadius and Cisco 2960 switches but I didn't find this solution ideal/intuitive, especially because devices are totally dis-associated from users. It seems to be more natural to authenticate users based on their personal (ldap-based) credentials and devices based on their MAC addresses alone. But of course, I may be wrong... 3. Use an non-LDAP store, e.g. MySQL. I would be grateful to people here who have already dealt with this issue and would be eager to share their experience. Any reference(s) to relevant documents regarding the above will be valuable too! Thanks in advance. Cheers, Nick

1 0

Restoring from prod into qa
by John C. Pfeifer 12 Jun '20

12 Jun '20

I have a both a production cluster and a qa cluster of servers. Each cluster is setup with multi-master (mirror-mode) delta-sync replication. On a weekly basis, I need to reload the data in qa from production. My problem is that, after successfully loading the dump, there is an epic flurry of replication events which tend to exhaust my burst balances in AWS. While I could request more resources (at a greater cost), I first want to verify that I have a reasonable process. On one of the production servers, I generate a dump: /usr/sbin/slapcat -F /etc/openldap/slapd.d -b dc=umd,dc=edu -l dump.ldif On each of the qa servers (simultaneously): 1) fetch the dump 2) delete the dc=umd,dc=edu and cn=accesslog LMDB files 3) /usr/sbin/slapadd -F /etc/openldap/slapd.d -b dc=umd,dc=edu -q -w -S 0 -l dump.ldif Is this a reasonable approach? Is the use of the ‘-S’ flag correct? Should I be modifying the dump in any manner (e.g. deleting the entryCSN attributes)? Thanks for any advise. // John Pfeifer Division of Information Technology University of Maryland, College Park

3 2

Rewriting attribute.
by Jan Hugo Prins 11 Jun '20

11 Jun '20

Hello, I'm trying to do a rewrite using the rwm overlay: I'm trying to rewrite uid: user1-branch1 to uid: user1 Some context: We have the following situation: We have a central OpenLDAP with several OU's. In these OU's we have user SubOU's and a user has a UID that is a combination of his CN with a dash and an abbreviation for the OU he is living in. For example: OU=Branch1,DC=Example,DC=ORG User 1: dn=User1,OU=Branch1,DC=Example,DC=ORG cn=User1 uid=User1-Branch1 OU=Branch2,DC=Example,DC=ORG User 1: dn=User1,OU=Branch1,DC=Example,DC=ORG cn=User1 uid=User1-Branch2 The reason this is done in the past (15 or 20 years ago) was that they wanted to have multiple branches and people could authenticate with the cn within there own branch. All very complicated history, but I have to work with it now. Someone setup a new Samba server a while back and wanted to normalize this Samba config a little so he created a LDAP proxy on this server where he proxied only one OU and did a rwm map from cn to uid. Part of this config: overlay rwm rwm-map attribute uid cn This works fine to some extend. One of the problems I found just now is that I don't have a cn anymore in the DN's that I get from this LDAP proxy, besides that, if the proxy has to much access and you search for a uid=User1 it will return both User1 from Branch1 and Branch2, and this could result in some security issues. For this reason I'm currently doing a little redesign of this setup and I would like to change the rwm-map to a rewrite of the uid where I simply strip everything including the dash in the uid, besides that I'm going to limit access of this proxy by using a proxy user with limited access to only the OU that it needs access to. The access limitation works just fine. I only need a little help with the rewrite. Thanks, Jan Hugo Prins

1 1

Configuring multiple proxies for Mirror-Mode
by wayne.mcnaught＠landregistry.gov.uk 11 Jun '20

11 Jun '20

I am looking for some advice and information. I have configured multiple LDAPs in a Mirror-Mode configuration and fronted by OpenLDAP in proxy mode. I understand that the list contained in the DBURI attribute is used to define the backends, and all the proxies are configured with the same list. I understand that first URI in the DbURI attribute will be used unless this fails, in which case it will fall back to the second URI. It will then keep on the second one until that one fails. This seems fine for most failure cases, when all proxies recognise the same failure. If communication fails between one proxy and the one backend LDAP and doesn't affect all proxies, writes will now be directed to different backends from different proxies. Is there some way to keep the proxies in-line or recognise a failure on one proxy and force the others to change. Thanks in advance Wayne McNaught

2 1

slapadd gives confusing output - str2entry
by Scott Classen 11 Jun '20

11 Jun '20

Hello, I’m setting up a new openldap(2.4.50) server and am running into this odd error message when importing my initial slapd.ldif file: # slapadd -v -n 0 -F slapd.d -l slapd.ldif added: "cn=config" (00000001) added: "cn=module{0},cn=config" (00000001) added: "cn=schema,cn=config" (00000001) added: "cn={0}core,cn=schema,cn=config" (00000001) added: "cn={1}cosine,cn=schema,cn=config" (00000001) added: "cn={2}inetorgperson,cn=schema,cn=config" (00000001) added: "cn={3}rfc2307bis,cn=schema,cn=config" (00000001) added: "cn={4}openldap,cn=schema,cn=config" (00000001) added: "cn={5}ppolicy,cn=schema,cn=config" (00000001) added: "cn={6}misc,cn=schema,cn=config" (00000001) added: "olcDatabase={-1}frontend,cn=config" (00000001) added: "olcDatabase={1}mdb,cn=config" (00000001) added: "olcOverlay={0}ppolicy,olcDatabase={1}mdb,cn=config" (00000001) added: "olcOverlay={1}memberof,olcDatabase={1}mdb,cn=config" (00000001) added: "olcOverlay={2}refint,olcDatabase={1}mdb,cn=config" (00000001) 5ee172af str2entry: entry -1 has no dn slapadd: could not parse entry (line=1500) _#################### 100.00% eta none elapsed none fast! Closing DB… Slapadd claims to have completed 100%, but also complains about entry -1 having no dn: Any advice? Cheers, Scott ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scott Classen, Ph.D. ALS-ENABLE TomAlberTron Beamline 8.3.1 SIBYLS Beamline 12.3.1 Advanced Light Source Lawrence Berkeley National Laboratory 1 Cyclotron Rd MS6R2100 Berkeley, CA 94720 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3 6

SSL Multi Master setup issue
by Aric Wilisch 10 Jun '20

10 Jun '20

Hey everyone. Just setup a multi master configuration on two openldap 2.4 systems on Centos 7. Replication seems to be working and I can do ldapsearches with ldap or ldaps while I'm ON the boxes. I'm finding when I try to do a ldapsearch using ldaps from an external box I get the following error: Jun 09 18:36:29 prod-openldap-01 slapd[20102]: conn=1301 fd=19 TLS established tls_ssf=256 ssf=256 Jun 09 18:36:29 prod-openldap-01 slapd[20102]: conn=1301 fd=19 closed (connection lost) Example search : ldapsearch -x -LLL -W -D "cn=ldapadm,dc=<domain redacted>,dc=com" -H ldaps://public-ldap-01.<domain redacted> -b 'dc=<domain redacted>,dc=com' -s sub "(objectclass=uid)" * in /etc/sysconfig/slapd I have the following: SLAPD_URLS="ldapi:/// ldap://stage-openldap-01.<domain redacted> ldaps:///" The ldap:// address reflects what was setup for the olcServerID when I was setting up. However if I check slaptest -f /etc/sysconfig/slapd -v I get: 5ee10c18 /etc/sysconfig/slapd: line 10: unknown directive <SLAPD_URLS=ldapi:/// ldap://stage-openldap-01.<domain redacted>.com ldaps:///> outside backend info and database definitions. slaptest: bad configuration file! I haven't setup an ldap server in years so I'm not sure where my problem is. If I can get external auth and searches working via ldaps the build will be complete. Appreciate any help anyone can give. Regards, Aric Sent from Mailspring (https://link.getmailspring.com/link/CD141FF0-8BD1-4F0B-9E01-62C712ABDDD8@ge…), the best free email app for work

1 0

Re: Aw: Re: Antw: [EXT] Re: Unexpected LMDB RSS /performance difference on similar machines
by Howard Chu 08 Jun '20

08 Jun '20

Ulrich Windl wrote: > Hi! > > (Sorry this mail frontent is unable to quote properly, so I top-post) > > In https://git.openldap.org/openldap/openldap/-/blob/13f3bcd59c2055d53e4759b0c… the comment basically says "Note that we don't currently support Huge pages." The comment says huge pages are not pageable. Which is still true in all current versions of Linux, as well as every other operating system. > > In https://www.openldap.org/lists/openldap-technical/201401/msg00213.html I had asked whether pages will be swapped when loading a 20GB database into 4GB of RAM and you said "No". I doubted that and in your unique way (not to call it "insulting") you said "You've already demonstrated multiple times that "as far as you know" is not far at all." > > Howard I think there is no need to be that rude. I have zero tolerance for bullshit, which is what you post. You make stupid guesses when the facts are already clearly documented, but you're too lazy to read them yourself. Your guesses are worthless, and the actual facts are readily available. Guesses contribute nothing but noise. > > Regarding the comment in https://git.openldap.org/openldap/openldap/-/blob/13f3bcd59c2055d53e4759b0c…, it seems the comment contradicts to what you claimed in https://www.openldap.org/lists/openldap-technical/201401/msg00213.html, namely " > We rely on the OS > * demand-pager to read our data and page it out when memory > * pressure from other processes is high. > ". In mail you doubted that pages would be "swapped". I did not "doubt" - I *know*. Because again, these are readily verifiable facts. Which you are still ignorant of, and you continue to neglect educating yourself about them. The mmap'd pages that LMDB uses are pageable. They never get swapped. These are two similar but distinct operations. If you would bother to read and educate yourself you would understand that. Instead you continue to spout unsubstantiated nonsense. > > Regards, > Ulrich > >>>> Howard Chu 08.06.2020, 14:02 >>> > Ulrich Windl wrote: >>>>> Howard Chu <hyc(a)symas.com> schrieb am 07.06.2020 um 22:44 in Nachricht >> <14412_1591562670_5EDD51AD_14412_294_1_79b319e0-fa23-a622-893b-b1b558a9385c@syma >> .com>: >>> Alec Matusis wrote: >>>> 2. dd reads the entire environment file into system file buffers (93GB). >>> Then when the entire environment is cached, I run the binary with >>> MDB_NORDAHEAD, but now it reads 80GB into shared memory, like when >>> MDB_NORDAHEAD is not set. Is this expected? Can it be prevented? >>> >>> It's not reading anything, since the data is already cached in memory. >>> >>> Is this expected? Yes - the data is already present, and LMDB always >>> requests a single mmap for the entire size of the environment. Since >>> the physical memory is already assigned, the mmap contains it all. >>> >>> Can it be prevented - why does it matter? If any other process needs >>> to use the RAM, it will get it automatically. >> >> While reading this: The amount of memory could suggest that using the >> hugepages feature could speed up things, especially if most of the mmapped data >> is expected to reside in RAM. Hugepages need to be enabled using >> vm.nr_hugepages=... in /etc/sysctl.conf (or corresponding). However I don't >> know whether LMDB can use them. >> >> A current AMD CPU offers these page sizes: 4k, 2M, and 1G, but some VMs (like >> Xen) can't use it. On the system I see, hugepages are 2MB on size. I don't know >> what the internal block size of LMDB is, but likely it would benefit to match >> the hugepage size if using it... > https://git.openldap.org/openldap/openldap/-/blob/13f3bcd59c2055d53e4759b0c… > We have already had this discussion, and your suggestion was irrelevant back then too. > https://www.openldap.org/lists/openldap-technical/201401/msg00213.html > Please stop posting disinformation. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

multi-threaded argon2 hashing
by Manuela Mandache 08 Jun '20

08 Jun '20

Hello all, I compiled pw-argon2 for OpenLDAP 2.4.44 (running on CentOS 7) and configured the directory to use the {ARGON2} password scheme. Everything works fine, only it seems the parallelism remains 1 whatever parameter I give when I load the module. Memory usage and number of iterations do follow the values I give at module load. Here's cn=module,cn=config: dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib64/openldap olcModuleLoad: {0}ppolicy olcModuleLoad: {1}syncprov olcModuleLoad: {2}accesslog olcModuleLoad: {3}pw-argon2 m=4096 t=8 p=8 And here's (the beginning of) a password which has been changed using ldappasswd (base64 decoded value obtained with ldapsearch): {ARGON2}$argon2id$v=19$m=4096,t=8,p=1$7KxBUtls1NNPDK4Q4f+....... What am I missing? I don't know if this is relevant, libsodium version is 1.0.18 and I compiled pw-argon2 using the libraries provided by openldap-2.4.44-21.el7_6.src.rpm. Let me know if I need to provide other configuration elements. Two more points: - the pw-argon2 man page (and README file of the module) examples seem to be obtained using argon2i, while the module uses argon2id; - what salt length is used? Thanks for your help, best regards, Manuela

3 5

Re: ppolicy: attempting to load ppolicy module
by John Alexander 08 Jun '20

08 Jun '20

This LDAP is an inherited project that has taken me quite some time to begin to understand and ACLs are certainly on my list. slapcat was working properly until I applied the ppolicy overlay. Then I started to get the error. The order I did was: slapcat -n 0 to pull a backup (this worked) apply the ppolicy schema apply the ppolicy module (or try - this seems to be where it started to go wrong) apply the ppolicy overlay (a bad decision in retrospect) for better or worse, I attempted to load the module ppolicy.la (rather than ppolicy - with no .la) and got this error: SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "cn=module{0},cn=config" ldap_modify: Other (e.g., implementation specific) error (80) However ldapsearch of cn=module{0},cn=config shows this: # module{0}, config dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib64/openldap olcModuleLoad: {0}back_bdb olcModuleLoad: {1}syncprov olcModuleLoad: {2}ppolicy olcModuleLoad: {3}ppolicy.la examination of cn=module{0}.ldif shows that the last 2 entries are not being written The systemd unit file is getting the following: SLAPD_CONFIG_FILE=/etc/openldap/slapd.conf (which does not exist) SLAPD_CONFIG_DIR=/etc/openldap/slapd.d (this is correct) So it <appears> that it is working with the correct directory. Permissions and ownership is correct. For some reason, it appears that ldapmodify is not writing to cn=module{0}.ldif I apologize if my conjecture is off base. John Alexander On Mon, Jun 8, 2020 at 12:12 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Monday, June 8, 2020 12:23 PM -0700 John Alexander > <jalexander(a)concentricsky.com> wrote: > > > > > > > Thank you for your patience, Quanah. The ldapsearch output of cn=config > > is below (with passwords redacted): > > What you really need to track down is where slapd's configuration is > actually stored, so you can slapcat it correctly. The ldapsearch output > shows a valid configuration, where ppolicy is loaded, the schema exists, > and the overlay is attached to the HDB database. > > Your ACLs are a bit of a mess, and I think that "by * read" on > userPassword > is a *very* bad idea, but the first part needs fixing first. > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > -- John Alexander Systems Administrator E: jalexander(a)concentricsky.com Concentric Sky, Inc https://www.concentricsky.com

2 1

Re: userPassword is not replicated
by Quanah Gibson-Mount 08 Jun '20

08 Jun '20

--On Saturday, June 6, 2020 3:51 PM +0000 razvan popescu <razvanpopescu(a)hotmail.com> wrote: > > Hi, > > > Openldap 2.4.44 on redhat 7.x How are you determining that userPassword is not being replicated? Given that you're using the rootdn, there are no limits in place that would prevent entries from replicating identicaly between the provider and consumer nodes. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: ppolicy: attempting to load ppolicy module
by John Alexander 08 Jun '20

08 Jun '20

Thank you for your patience, Quanah. The ldapsearch output of cn=config is below (with passwords redacted): # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: (objectclass=*) # requesting: ALL # # config dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/openldap/slapd.args olcLogLevel: stats acl sync olcPidFile: /var/run/openldap/slapd.pid olcTLSCACertificateFile: /etc/openldap/certs/ldap.concentricsky.com.chain.crt olcTLSCACertificatePath: /etc/openldap/certs olcTLSCertificateFile: /etc/openldap/certs/ldap.concentricsky.com.crt olcTLSCertificateKeyFile: /etc/openldap/certs/ldap.concentricsky.com.key # module{0}, config dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib64/openldap olcModuleLoad: {0}back_bdb olcModuleLoad: {1}syncprov olcModuleLoad: {2}ppolicy # schema, config dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema olcObjectIdentifier: OLcfg 1.3.6.1.4.1.4203.1.12.2 olcObjectIdentifier: OLcfgAt OLcfg:3 olcObjectIdentifier: OLcfgGlAt OLcfgAt:0 olcObjectIdentifier: OLcfgBkAt OLcfgAt:1 olcObjectIdentifier: OLcfgDbAt OLcfgAt:2 olcObjectIdentifier: OLcfgOvAt OLcfgAt:3 olcObjectIdentifier: OLcfgCtAt OLcfgAt:4 olcObjectIdentifier: OLcfgOc OLcfg:4 olcObjectIdentifier: OLcfgGlOc OLcfgOc:0 olcObjectIdentifier: OLcfgBkOc OLcfgOc:1 olcObjectIdentifier: OLcfgDbOc OLcfgOc:2 olcObjectIdentifier: OLcfgOvOc OLcfgOc:3 olcObjectIdentifier: OLcfgCtOc OLcfgOc:4 olcObjectIdentifier: OMsyn 1.3.6.1.4.1.1466.115.121.1 olcObjectIdentifier: OMsBoolean OMsyn:7 olcObjectIdentifier: OMsDN OMsyn:12 olcObjectIdentifier: OMsDirectoryString OMsyn:15 olcObjectIdentifier: OMsIA5String OMsyn:26 olcObjectIdentifier: OMsInteger OMsyn:27 olcObjectIdentifier: OMsOID OMsyn:38 olcObjectIdentifier: OMsOctetString OMsyn:40 olcObjectIdentifier: olmAttributes 1.3.6.1.4.1.4203.666.1.55 olcObjectIdentifier: olmSubSystemAttributes olmAttributes:0 olcObjectIdentifier: olmGenericAttributes olmSubSystemAttributes:0 olcObjectIdentifier: olmDatabaseAttributes olmSubSystemAttributes:1 olcObjectIdentifier: olmObjectClasses 1.3.6.1.4.1.4203.666.3.16 olcObjectIdentifier: olmSubSystemObjectClasses olmObjectClasses:0 olcObjectIdentifier: olmGenericObjectClasses olmSubSystemObjectClasses:0 olcObjectIdentifier: olmDatabaseObjectClasses olmSubSystemObjectClasses:1 olcObjectIdentifier: olmBDBAttributes olmDatabaseAttributes:1 olcObjectIdentifier: olmBDBObjectClasses olmDatabaseObjectClasses:1 olcAttributeTypes: ( 2.5.4.0 NAME 'objectClass' DESC 'RFC4512: object classes of the entity' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121 .1.38 ) olcAttributeTypes: ( 2.5.21.9 NAME 'structuralObjectClass' DESC 'RFC4512: stru ctural object class of entry' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4 .1.1466.115.121.1.38 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperati on ) olcAttributeTypes: ( 2.5.18.1 NAME 'createTimestamp' DESC 'RFC4512: time which object was created' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOr deringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-MODIFIC ATION USAGE directoryOperation ) olcAttributeTypes: ( 2.5.18.2 NAME 'modifyTimestamp' DESC 'RFC4512: time which object was last modified' EQUALITY generalizedTimeMatch ORDERING generalized TimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-M ODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 2.5.18.3 NAME 'creatorsName' DESC 'RFC4512: name of creat or' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SING LE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 2.5.18.4 NAME 'modifiersName' DESC 'RFC4512: name of last modifier' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1. 12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 2.5.18.9 NAME 'hasSubordinates' DESC 'X.501: entry has ch ildren' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALU E NO-USER-MODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 2.5.18.10 NAME 'subschemaSubentry' DESC 'RFC4512: name of controlling subschema entry' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1. 4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperat ion ) olcAttributeTypes: ( 1.3.6.1.1.20 NAME 'entryDN' DESC 'DN of the entry' EQUALI TY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE N O-USER-MODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 1.3.6.1.1.16.4 NAME 'entryUUID' DESC 'UUID of the entry' EQUALITY UUIDMatch ORDERING UUIDOrderingMatch SYNTAX 1.3.6.1.1.16.1 SINGLE-VA LUE NO-USER-MODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.7 NAME 'entryCSN' DESC 'change seq uence number of the entry content' EQUALITY CSNMatch ORDERING CSNOrderingMatc h SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} SINGLE-VALUE NO-USER-MODIFICATION US AGE directoryOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.13 NAME 'namingCSN' DESC 'change s equence number of the entry naming (RDN)' EQUALITY CSNMatch ORDERING CSNOrder ingMatch SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} SINGLE-VALUE NO-USER-MODIFICA TION USAGE directoryOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.23 NAME 'syncreplCookie' DESC 'syn crepl Cookie for shadow copy' EQUALITY octetStringMatch ORDERING octetStringO rderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE NO-USER-MODIFI CATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.25 NAME 'contextCSN' DESC 'the lar gest committed CSN of a context' EQUALITY CSNMatch ORDERING CSNOrderingMatch SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} NO-USER-MODIFICATION USAGE dSAOperatio n ) olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.6 NAME 'altServer' DESC 'RFC4512 : alternative servers' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 USAGE dSAOperatio n ) olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.5 NAME 'namingContexts' DESC 'RF C4512: naming contexts' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 USAGE dSAOperati on ) olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.13 NAME 'supportedControl' DESC 'RFC4512: supported controls' SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAO peration ) olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.7 NAME 'supportedExtension' DESC 'RFC4512: supported extended operations' SYNTAX 1.3.6.1.4.1.1466.115.121.1.3 8 USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.15 NAME 'supportedLDAPVersion' D ESC 'RFC4512: supported LDAP versions' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 U SAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.14 NAME 'supportedSASLMechanisms ' DESC 'RFC4512: supported SASL mechanisms' SYNTAX 1.3.6.1.4.1.1466.115.121.1 .15 USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.1.3.5 NAME 'supportedFeatures' DESC 'RFC 4512: features supported by the server' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.10 NAME 'monitorContext' DESC 'mon itor context' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121 .1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.1 NAME 'configContext' DESC 'conf ig context' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1 .12 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.1.4 NAME 'vendorName' DESC 'RFC3045: name of impl ementation vendor' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1. 15 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.1.5 NAME 'vendorVersion' DESC 'RFC3045: version o f implementation' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.1 5 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 2.5.18.5 NAME 'administrativeRole' DESC 'RFC3672: adminis trative role' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121. 1.38 USAGE directoryOperation ) olcAttributeTypes: ( 2.5.18.6 NAME 'subtreeSpecification' DESC 'RFC3672: subtr ee specification' SYNTAX 1.3.6.1.4.1.1466.115.121.1.45 SINGLE-VALUE USAGE dir ectoryOperation ) olcAttributeTypes: ( 2.5.21.1 NAME 'dITStructureRules' DESC 'RFC4512: DIT stru cture rules' EQUALITY integerFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115. 121.1.17 USAGE directoryOperation ) olcAttributeTypes: ( 2.5.21.2 NAME 'dITContentRules' DESC 'RFC4512: DIT conten t rules' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466 .115.121.1.16 USAGE directoryOperation ) olcAttributeTypes: ( 2.5.21.4 NAME 'matchingRules' DESC 'RFC4512: matching rul es' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115. 121.1.30 USAGE directoryOperation ) olcAttributeTypes: ( 2.5.21.5 NAME 'attributeTypes' DESC 'RFC4512: attribute t ypes' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.11 5.121.1.3 USAGE directoryOperation ) olcAttributeTypes: ( 2.5.21.6 NAME 'objectClasses' DESC 'RFC4512: object class es' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115. 121.1.37 USAGE directoryOperation ) olcAttributeTypes: ( 2.5.21.7 NAME 'nameForms' DESC 'RFC4512: name forms ' EQU ALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.3 5 USAGE directoryOperation ) olcAttributeTypes: ( 2.5.21.8 NAME 'matchingRuleUse' DESC 'RFC4512: matching r ule uses' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.146 6.115.121.1.31 USAGE directoryOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.16 NAME 'ldapSyntaxes' DESC 'RFC 4512: LDAP syntaxes' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3. 6.1.4.1.1466.115.121.1.54 USAGE directoryOperation ) olcAttributeTypes: ( 2.5.4.1 NAME ( 'aliasedObjectName' 'aliasedEntryName' ) D ESC 'RFC4512: name of aliased object' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE ) olcAttributeTypes: ( 2.16.840.1.113730.3.1.34 NAME 'ref' DESC 'RFC3296: subord inate referral URL' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1 .15 USAGE distributedOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.1.3.1 NAME 'entry' DESC 'OpenLDAP ACL en try pseudo-attribute' SYNTAX 1.3.6.1.4.1.4203.1.1.1 SINGLE-VALUE NO-USER-MODI FICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.1.3.2 NAME 'children' DESC 'OpenLDAP ACL children pseudo-attribute' SYNTAX 1.3.6.1.4.1.4203.1.1.1 SINGLE-VALUE NO-USE R-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.8 NAME ( 'authzTo' 'saslAuthzTo' ) DESC 'proxy authorization targets' EQUALITY authzMatch SYNTAX 1.3.6.1.4.1.42 03.666.2.7 USAGE distributedOperation X-ORDERED 'VALUES' ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.9 NAME ( 'authzFrom' 'saslAuthzFro m' ) DESC 'proxy authorization sources' EQUALITY authzMatch SYNTAX 1.3.6.1.4. 1.4203.666.2.7 USAGE distributedOperation X-ORDERED 'VALUES' ) olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.119.3 NAME 'entryTtl' DESC 'RFC2589: entry time-to-live' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE NO-USE R-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.119.4 NAME 'dynamicSubtrees' DESC 'R FC2589: dynamic subtrees' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 NO-USER-MODIFI CATION USAGE dSAOperation ) olcAttributeTypes: ( 2.5.4.49 NAME 'distinguishedName' DESC 'RFC4519: common s upertype of DN attributes' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1 .1466.115.121.1.12 ) olcAttributeTypes: ( 2.5.4.41 NAME 'name' DESC 'RFC4519: common supertype of n ame attributes' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYN TAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) olcAttributeTypes: ( 2.5.4.3 NAME ( 'cn' 'commonName' ) DESC 'RFC4519: common name(s) for which the entity is known by' SUP name ) olcAttributeTypes: ( 0.9.2342.19200300.100.1.1 NAME ( 'uid' 'userid' ) DESC 'R FC4519: user identifier' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstrings Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: ( 1.3.6.1.1.1.1.0 NAME 'uidNumber' DESC 'RFC2307: An intege r uniquely identifying a user in an administrative domain' EQUALITY integerMa tch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE -VALUE ) olcAttributeTypes: ( 1.3.6.1.1.1.1.1 NAME 'gidNumber' DESC 'RFC2307: An intege r uniquely identifying a group in an administrative domain' EQUALITY integerM atch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGL E-VALUE ) olcAttributeTypes: ( 2.5.4.35 NAME 'userPassword' DESC 'RFC4519/2307: password of user' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128} ) olcAttributeTypes: ( 1.3.6.1.4.1.250.1.57 NAME 'labeledURI' DESC 'RFC2079: Uni form Resource Identifier with optional label' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: ( 2.5.4.13 NAME 'description' DESC 'RFC4519: descriptive in formation' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1 .3.6.1.4.1.1466.115.121.1.15{1024} ) olcAttributeTypes: ( 2.5.4.34 NAME 'seeAlso' DESC 'RFC4519: DN of related obje ct' SUP distinguishedName ) olcAttributeTypes: ( OLcfgGlAt:78 NAME 'olcConfigFile' DESC 'File for slapd co nfiguration directives' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString SI NGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:79 NAME 'olcConfigDir' DESC 'Directory for slap d configuration backend' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString S INGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:1 NAME 'olcAccess' DESC 'Access Control List' E QUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgGlAt:86 NAME 'olcAddContentAcl' DESC 'Check ACLs aga inst content of Add ops' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:2 NAME 'olcAllows' DESC 'Allowed set of depreca ted features' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgGlAt:3 NAME 'olcArgsFile' DESC 'File for slapd comma nd line options' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VA LUE ) olcAttributeTypes: ( OLcfgGlAt:5 NAME 'olcAttributeOptions' EQUALITY caseIgnor eMatch SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgGlAt:4 NAME 'olcAttributeTypes' DESC 'OpenLDAP attri buteTypes' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX O MsDirectoryString X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgGlAt:6 NAME 'olcAuthIDRewrite' EQUALITY caseIgnoreMa tch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgGlAt:7 NAME 'olcAuthzPolicy' EQUALITY caseIgnoreMatc h SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:8 NAME 'olcAuthzRegexp' EQUALITY caseIgnoreMatc h SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgGlAt:9 NAME 'olcBackend' DESC 'A type of backend' EQ UALITY caseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VALUE X-ORDERED 'SIBL INGS' ) olcAttributeTypes: ( OLcfgGlAt:10 NAME 'olcConcurrency' SYNTAX OMsInteger SING LE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:11 NAME 'olcConnMaxPending' SYNTAX OMsInteger S INGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:12 NAME 'olcConnMaxPendingAuth' SYNTAX OMsInteg er SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:13 NAME 'olcDatabase' DESC 'The backend type fo r a database instance' SUP olcBackend SINGLE-VALUE X-ORDERED 'SIBLINGS' ) olcAttributeTypes: ( OLcfgGlAt:14 NAME 'olcDefaultSearchBase' SYNTAX OMsDN SIN GLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:15 NAME 'olcDisallows' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgGlAt:16 NAME 'olcDitContentRules' DESC 'OpenLDAP DIT content rules' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYN TAX OMsDirectoryString X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgDbAt:0.20 NAME 'olcExtraAttrs' EQUALITY caseIgnoreMa tch SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgGlAt:17 NAME 'olcGentleHUP' SYNTAX OMsBoolean SINGLE -VALUE ) olcAttributeTypes: ( OLcfgDbAt:0.17 NAME 'olcHidden' SYNTAX OMsBoolean SINGLE- VALUE ) olcAttributeTypes: ( OLcfgGlAt:18 NAME 'olcIdleTimeout' SYNTAX OMsInteger SING LE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:19 NAME 'olcInclude' SUP labeledURI ) olcAttributeTypes: ( OLcfgGlAt:20 NAME 'olcIndexSubstrIfMinLen' SYNTAX OMsInte ger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:21 NAME 'olcIndexSubstrIfMaxLen' SYNTAX OMsInte ger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:22 NAME 'olcIndexSubstrAnyLen' SYNTAX OMsIntege r SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:23 NAME 'olcIndexSubstrAnyStep' SYNTAX OMsInteg er SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:84 NAME 'olcIndexIntLen' SYNTAX OMsInteger SING LE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:0.4 NAME 'olcLastMod' SYNTAX OMsBoolean SINGLE- VALUE ) olcAttributeTypes: ( OLcfgGlAt:85 NAME 'olcLdapSyntaxes' DESC 'OpenLDAP ldapSy ntax' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX OMsDir ectoryString X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgDbAt:0.5 NAME 'olcLimits' EQUALITY caseIgnoreMatch S YNTAX OMsDirectoryString X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgGlAt:93 NAME 'olcListenerThreads' SYNTAX OMsInteger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:26 NAME 'olcLocalSSF' SYNTAX OMsInteger SINGLE- VALUE ) olcAttributeTypes: ( OLcfgGlAt:27 NAME 'olcLogFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:28 NAME 'olcLogLevel' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgDbAt:0.6 NAME 'olcMaxDerefDepth' SYNTAX OMsInteger S INGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:0.16 NAME 'olcMirrorMode' SYNTAX OMsBoolean SIN GLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:30 NAME 'olcModuleLoad' EQUALITY caseIgnoreMatc h SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgGlAt:31 NAME 'olcModulePath' SYNTAX OMsDirectoryStri ng SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:0.18 NAME 'olcMonitoring' SYNTAX OMsBoolean SIN GLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:32 NAME 'olcObjectClasses' DESC 'OpenLDAP objec t classes' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX O MsDirectoryString X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgGlAt:33 NAME 'olcObjectIdentifier' EQUALITY caseIgno reMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgGlAt:34 NAME 'olcOverlay' SUP olcDatabase SINGLE-VAL UE X-ORDERED 'SIBLINGS' ) olcAttributeTypes: ( OLcfgGlAt:35 NAME 'olcPasswordCryptSaltFormat' SYNTAX OMs DirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:36 NAME 'olcPasswordHash' EQUALITY caseIgnoreMa tch SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgGlAt:37 NAME 'olcPidFile' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:38 NAME 'olcPlugin' EQUALITY caseIgnoreMatch SY NTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgGlAt:39 NAME 'olcPluginLogFile' SYNTAX OMsDirectoryS tring SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:40 NAME 'olcReadOnly' SYNTAX OMsBoolean SINGLE- VALUE ) olcAttributeTypes: ( OLcfgGlAt:41 NAME 'olcReferral' SUP labeledURI SINGLE-VAL UE ) olcAttributeTypes: ( OLcfgDbAt:0.7 NAME 'olcReplica' SUP labeledURI EQUALITY c aseIgnoreMatch X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgGlAt:43 NAME 'olcReplicaArgsFile' SYNTAX OMsDirector yString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:44 NAME 'olcReplicaPidFile' SYNTAX OMsDirectory String SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:45 NAME 'olcReplicationInterval' SYNTAX OMsInte ger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:46 NAME 'olcReplogFile' SYNTAX OMsDirectoryStri ng SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:47 NAME 'olcRequires' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgGlAt:48 NAME 'olcRestrict' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgGlAt:49 NAME 'olcReverseLookup' SYNTAX OMsBoolean SI NGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:0.8 NAME 'olcRootDN' EQUALITY distinguishedName Match SYNTAX OMsDN SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:51 NAME 'olcRootDSE' EQUALITY caseIgnoreMatch S YNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgDbAt:0.9 NAME 'olcRootPW' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:89 NAME 'olcSaslAuxprops' SYNTAX OMsDirectorySt ring SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:53 NAME 'olcSaslHost' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:54 NAME 'olcSaslRealm' SYNTAX OMsDirectoryStrin g SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:56 NAME 'olcSaslSecProps' SYNTAX OMsDirectorySt ring SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:58 NAME 'olcSchemaDN' EQUALITY distinguishedNam eMatch SYNTAX OMsDN SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:59 NAME 'olcSecurity' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgGlAt:81 NAME 'olcServerID' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgGlAt:60 NAME 'olcSizeLimit' SYNTAX OMsDirectoryStrin g SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:61 NAME 'olcSockbufMaxIncoming' SYNTAX OMsInteg er SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:62 NAME 'olcSockbufMaxIncomingAuth' SYNTAX OMsI nteger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:83 NAME 'olcSortVals' DESC 'Attributes whose va lues will always be sorted' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryStrin g ) olcAttributeTypes: ( OLcfgDbAt:0.15 NAME 'olcSubordinate' SYNTAX OMsDirectoryS tring SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:0.10 NAME 'olcSuffix' EQUALITY distinguishedNam eMatch SYNTAX OMsDN ) olcAttributeTypes: ( OLcfgDbAt:0.19 NAME 'olcSyncUseSubentry' DESC 'Store sync context in a subentry' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:0.11 NAME 'olcSyncrepl' EQUALITY caseIgnoreMatc h SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgGlAt:90 NAME 'olcTCPBuffer' DESC 'Custom TCP buffer size' SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgGlAt:66 NAME 'olcThreads' SYNTAX OMsInteger SINGLE-V ALUE ) olcAttributeTypes: ( OLcfgGlAt:67 NAME 'olcTimeLimit' SYNTAX OMsDirectoryStrin g ) olcAttributeTypes: ( OLcfgGlAt:68 NAME 'olcTLSCACertificateFile' SYNTAX OMsDir ectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:69 NAME 'olcTLSCACertificatePath' SYNTAX OMsDir ectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:70 NAME 'olcTLSCertificateFile' SYNTAX OMsDirec toryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:71 NAME 'olcTLSCertificateKeyFile' SYNTAX OMsDi rectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:72 NAME 'olcTLSCipherSuite' SYNTAX OMsDirectory String SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:73 NAME 'olcTLSCRLCheck' SYNTAX OMsDirectoryStr ing SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:82 NAME 'olcTLSCRLFile' SYNTAX OMsDirectoryStri ng SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:74 NAME 'olcTLSRandFile' SYNTAX OMsDirectoryStr ing SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:75 NAME 'olcTLSVerifyClient' SYNTAX OMsDirector yString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:77 NAME 'olcTLSDHParamFile' SYNTAX OMsDirectory String SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:96 NAME 'olcTLSECName' SYNTAX OMsDirectoryStrin g SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:87 NAME 'olcTLSProtocolMin' SYNTAX OMsDirectory String SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:80 NAME 'olcToolThreads' SYNTAX OMsInteger SING LE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:0.12 NAME 'olcUpdateDN' SYNTAX OMsDN SINGLE-VAL UE ) olcAttributeTypes: ( OLcfgDbAt:0.13 NAME 'olcUpdateRef' SUP labeledURI EQUALIT Y caseIgnoreMatch ) olcAttributeTypes: ( OLcfgGlAt:88 NAME 'olcWriteTimeout' SYNTAX OMsInteger SIN GLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:0.1 NAME 'olcDbDirectory' DESC 'Directory for d atabase content' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VA LUE ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.1 NAME 'monitoredInfo' DESC 'mo nitored info' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTA X 1.3.6.1.4.1.1466.115.121.1.15{32768} NO-USER-MODIFICATION USAGE dSAOperatio n ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.2 NAME 'managedInfo' DESC 'moni tor managed info' SUP name ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.3 NAME 'monitorCounter' DESC 'm onitor counter' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1. 3.6.1.4.1.1466.115.121.1.27 NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.4 NAME 'monitorOpCompleted' DES C 'monitor completed operations' SUP monitorCounter NO-USER-MODIFICATION USAG E dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.5 NAME 'monitorOpInitiated' DES C 'monitor initiated operations' SUP monitorCounter NO-USER-MODIFICATION USAG E dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.6 NAME 'monitorConnectionNumber ' DESC 'monitor connection number' SUP monitorCounter NO-USER-MODIFICATION US AGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.7 NAME 'monitorConnectionAuthzD N' DESC 'monitor connection authorization DN' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.8 NAME 'monitorConnectionLocalA ddress' DESC 'monitor connection local address' SUP monitoredInfo NO-USER-MOD IFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.9 NAME 'monitorConnectionPeerAd dress' DESC 'monitor connection peer address' SUP monitoredInfo NO-USER-MODIF ICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.10 NAME 'monitorTimestamp' DESC 'monitor timestamp' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOr deringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-MODIFIC ATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.11 NAME 'monitorOverlay' DESC ' name of overlays defined for a given database' SUP monitoredInfo NO-USER-MODI FICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.12 NAME 'readOnly' DESC 'read/w rite status of a given database' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.146 6.115.121.1.7 SINGLE-VALUE USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.13 NAME 'restrictedOperation' D ESC 'name of restricted operation for a given database' SUP managedInfo ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.14 NAME 'monitorConnectionProto col' DESC 'monitor connection protocol' SUP monitoredInfo NO-USER-MODIFICATIO N USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.15 NAME 'monitorConnectionOpsRe ceived' DESC 'monitor number of operations received by the connection' SUP mo nitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.16 NAME 'monitorConnectionOpsEx ecuting' DESC 'monitor number of operations in execution within the connectio n' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.17 NAME 'monitorConnectionOpsPe nding' DESC 'monitor number of pending operations within the connection' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.18 NAME 'monitorConnectionOpsCo mpleted' DESC 'monitor number of operations completed within the connection' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.19 NAME 'monitorConnectionGet' DESC 'number of times connection_get() was called so far' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.20 NAME 'monitorConnectionRead' DESC 'number of times connection_read() was called so far' SUP monitorCounte r NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.21 NAME 'monitorConnectionWrite ' DESC 'number of times connection_write() was called so far' SUP monitorCoun ter NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.22 NAME 'monitorConnectionMask' DESC 'monitor connection mask' SUP monitoredInfo NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.23 NAME 'monitorConnectionListe ner' DESC 'monitor connection listener' SUP monitoredInfo NO-USER-MODIFICATIO N USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.24 NAME 'monitorConnectionPeerD omain' DESC 'monitor connection peer domain' SUP monitoredInfo NO-USER-MODIFI CATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.25 NAME 'monitorConnectionStart Time' DESC 'monitor connection start time' SUP monitorTimestamp SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.26 NAME 'monitorConnectionActiv ityTime' DESC 'monitor connection activity time' SUP monitorTimestamp SINGLE- VALUE NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.27 NAME 'monitorIsShadow' DESC 'TRUE if the database is shadow' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.146 6.115.121.1.7 SINGLE-VALUE USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.28 NAME 'monitorUpdateRef' DESC 'update referral for shadow databases' SUP monitoredInfo SINGLE-VALUE USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.29 NAME 'monitorRuntimeConfig' DESC 'TRUE if component allows runtime configuration' EQUALITY booleanMatch S YNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.30 NAME 'monitorSuperiorDN' DES C 'monitor superior DN' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.14 66.115.121.1.12 NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( OLcfgDbAt:1.11 NAME 'olcDbCacheFree' DESC 'Number of extr a entries to free when max is reached' SYNTAX OMsInteger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:1.1 NAME 'olcDbCacheSize' DESC 'Entry cache siz e in entries' SYNTAX OMsInteger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:1.2 NAME 'olcDbCheckpoint' DESC 'Database check point interval in kbytes and minutes' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:1.16 NAME 'olcDbChecksum' DESC 'Enable database checksum validation' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:1.13 NAME 'olcDbCryptFile' DESC 'Pathname of fi le containing the DB encryption key' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:1.14 NAME 'olcDbCryptKey' DESC 'DB encryption k ey' SYNTAX OMsOctetString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:1.3 NAME 'olcDbConfig' DESC 'BerkeleyDB DB_CONF IG configuration directives' SYNTAX OMsIA5String X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgDbAt:1.4 NAME 'olcDbNoSync' DESC 'Disable synchronou s database writes' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:1.15 NAME 'olcDbPageSize' DESC 'Page size of sp ecified DB, in Kbytes' EQUALITY caseExactMatch SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgDbAt:1.5 NAME 'olcDbDirtyRead' DESC 'Allow reads of uncommitted data' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:1.12 NAME 'olcDbDNcacheSize' DESC 'DN cache siz e' SYNTAX OMsInteger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:1.6 NAME 'olcDbIDLcacheSize' DESC 'IDL cache si ze in IDLs' SYNTAX OMsInteger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:0.2 NAME 'olcDbIndex' DESC 'Attribute index par ameters' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgDbAt:1.7 NAME 'olcDbLinearIndex' DESC 'Index attribu tes one at a time' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:1.8 NAME 'olcDbLockDetect' DESC 'Deadlock detec tion algorithm' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:0.3 NAME 'olcDbMode' DESC 'Unix permissions of database files' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:1.9 NAME 'olcDbSearchStack' DESC 'Depth of sear ch stack in IDLs' SYNTAX OMsInteger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:1.10 NAME 'olcDbShmKey' DESC 'Key for shared me mory region' SYNTAX OMsInteger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:12.3 NAME 'olcDbEnvFlags' DESC 'Database enviro nment flags' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgDbAt:12.1 NAME 'olcDbMaxReaders' DESC 'Maximum numbe r of threads that may access the DB concurrently' SYNTAX OMsInteger SINGLE-VA LUE ) olcAttributeTypes: ( OLcfgDbAt:12.2 NAME 'olcDbMaxSize' DESC 'Maximum size of DB in bytes' SYNTAX OMsInteger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:12.5 NAME 'olcDbRtxnSize' DESC 'Number of entri es to process in one read transaction' SYNTAX OMsInteger SINGLE-VALUE ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.5 NAME 'OpenLDAPaci' DESC 'OpenLDA P access control information (experimental)' EQUALITY OpenLDAPaciMatch SYNTAX 1.3.6.1.4.1.4203.666.2.1 USAGE directoryOperation ) olcAttributeTypes: ( OLcfgOvAt:1.1 NAME 'olcSpCheckpoint' DESC 'ContextCSN che ckpoint interval in ops and minutes' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgOvAt:1.2 NAME 'olcSpSessionlog' DESC 'Session log si ze in ops' SYNTAX OMsInteger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgOvAt:1.3 NAME 'olcSpNoPresent' DESC 'Omit Present ph ase processing' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgOvAt:1.4 NAME 'olcSpReloadHint' DESC 'Observe Reload Hint in Request control' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( olmBDBAttributes:1 NAME 'olmBDBEntryCache' DESC 'Number o f items in Entry Cache' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOper ation ) olcAttributeTypes: ( olmBDBAttributes:2 NAME 'olmBDBDNCache' DESC 'Number of i tems in DN Cache' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( olmBDBAttributes:3 NAME 'olmBDBIDLCache' DESC 'Number of items in IDL Cache' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperatio n ) olcAttributeTypes: ( olmDatabaseAttributes:1 NAME 'olmDbDirectory' DESC 'Path name of the directory where the database environment resides' SUP monitoredIn fo NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.16 NAME 'pwdChangedTime' DESC 'Th e time the password was last changed' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALU E NO-USER-MODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.17 NAME 'pwdAccountLockedTime' DE SC 'The time an user account was locked' EQUALITY generalizedTimeMatch ORDERI NG generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-V ALUE USAGE directoryOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.19 NAME 'pwdFailureTime' DESC 'Th e timestamps of the last consecutive authentication failures' EQUALITY genera lizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466. 115.121.1.24 NO-USER-MODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.20 NAME 'pwdHistory' DESC 'The hi story of users passwords' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.40 NO-USER-MODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.21 NAME 'pwdGraceUseTime' DESC 'T he timestamps of the grace login once the password has expired' EQUALITY gene ralizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 NO-USER-MODIFICATION US AGE directoryOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.22 NAME 'pwdReset' DESC 'The indi cation that the password has been reset' EQUALITY booleanMatch SYNTAX 1.3.6.1 .4.1.1466.115.121.1.7 SINGLE-VALUE USAGE directoryOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.23 NAME 'pwdPolicySubentry' DESC 'The pwdPolicy subentry in effect for this object' EQUALITY distinguishedName Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE USAGE directoryOperat ion ) olcAttributeTypes: ( OLcfgOvAt:12.1 NAME 'olcPPolicyDefault' DESC 'DN of a pwd Policy object for uncustomized objects' SYNTAX OMsDN SINGLE-VALUE ) olcAttributeTypes: ( OLcfgOvAt:12.2 NAME 'olcPPolicyHashCleartext' DESC 'Hash passwords on add or modify' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgOvAt:12.4 NAME 'olcPPolicyForwardUpdates' DESC 'Allo w policy state updates to be forwarded via updateref' SYNTAX OMsBoolean SINGL E-VALUE ) olcAttributeTypes: ( OLcfgOvAt:12.3 NAME 'olcPPolicyUseLockout' DESC 'Warn cli ents with AccountLocked' SYNTAX OMsBoolean SINGLE-VALUE ) olcObjectClasses: ( 2.5.6.0 NAME 'top' DESC 'top of the superclass chain' ABST RACT MUST objectClass ) olcObjectClasses: ( 1.3.6.1.4.1.1466.101.120.111 NAME 'extensibleObject' DESC 'RFC4512: extensible object' SUP top AUXILIARY ) olcObjectClasses: ( 2.5.6.1 NAME 'alias' DESC 'RFC4512: an alias' SUP top STRU CTURAL MUST aliasedObjectName ) olcObjectClasses: ( 2.16.840.1.113730.3.2.6 NAME 'referral' DESC 'namedref: na med subordinate referral' SUP top STRUCTURAL MUST ref ) olcObjectClasses: ( 1.3.6.1.4.1.4203.1.4.1 NAME ( 'OpenLDAProotDSE' 'LDAProotD SE' ) DESC 'OpenLDAP Root DSE object' SUP top STRUCTURAL MAY cn ) olcObjectClasses: ( 2.5.17.0 NAME 'subentry' DESC 'RFC3672: subentry' SUP top STRUCTURAL MUST ( cn $ subtreeSpecification ) ) olcObjectClasses: ( 2.5.20.1 NAME 'subschema' DESC 'RFC4512: controlling subsc hema (sub)entry' AUXILIARY MAY ( dITStructureRules $ nameForms $ dITContentRu les $ objectClasses $ attributeTypes $ matchingRules $ matchingRuleUse ) ) olcObjectClasses: ( 1.3.6.1.4.1.1466.101.119.2 NAME 'dynamicObject' DESC 'RFC2 589: Dynamic Object' SUP top AUXILIARY ) olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.4 NAME 'glue' DESC 'Glue Entry' SUP top STRUCTURAL ) olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.5 NAME 'syncConsumerSubentry' DESC 'Persistent Info for SyncRepl Consumer' AUXILIARY MAY syncreplCookie ) olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.6 NAME 'syncProviderSubentry' DESC 'Persistent Info for SyncRepl Producer' AUXILIARY MAY contextCSN ) olcObjectClasses: ( OLcfgGlOc:0 NAME 'olcConfig' DESC 'OpenLDAP configuration object' SUP top ABSTRACT ) olcObjectClasses: ( OLcfgGlOc:1 NAME 'olcGlobal' DESC 'OpenLDAP Global configu ration options' SUP olcConfig STRUCTURAL MAY ( cn $ olcConfigFile $ olcConfig Dir $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAuthIDRewrite $ olcA uthzPolicy $ olcAuthzRegexp $ olcConcurrency $ olcConnMaxPending $ olcConnMax PendingAuth $ olcDisallows $ olcGentleHUP $ olcIdleTimeout $ olcIndexSubstrIf MaxLen $ olcIndexSubstrIfMinLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnySte p $ olcIndexIntLen $ olcListenerThreads $ olcLocalSSF $ olcLogFile $ olcLogLe vel $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPluginLo gFile $ olcReadOnly $ olcReferral $ olcReplogFile $ olcRequires $ olcRestrict $ olcReverseLookup $ olcRootDSE $ olcSaslAuxprops $ olcSaslHost $ olcSaslRea lm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLimit $ olcSockbufM axIncoming $ olcSockbufMaxIncomingAuth $ olcTCPBuffer $ olcThreads $ olcTimeL imit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateF ile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSR andFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSECName $ olcTLSCRLFi le $ olcTLSProtocolMin $ olcToolThreads $ olcWriteTimeout $ olcObjectIdentifi er $ olcAttributeTypes $ olcObjectClasses $ olcDitContentRules $ olcLdapSynta xes ) ) olcObjectClasses: ( OLcfgGlOc:2 NAME 'olcSchemaConfig' DESC 'OpenLDAP schema o bject' SUP olcConfig STRUCTURAL MAY ( cn $ olcObjectIdentifier $ olcLdapSynta xes $ olcAttributeTypes $ olcObjectClasses $ olcDitContentRules ) ) olcObjectClasses: ( OLcfgGlOc:3 NAME 'olcBackendConfig' DESC 'OpenLDAP Backend -specific options' SUP olcConfig STRUCTURAL MUST olcBackend ) olcObjectClasses: ( OLcfgGlOc:4 NAME 'olcDatabaseConfig' DESC 'OpenLDAP Databa se-specific options' SUP olcConfig STRUCTURAL MUST olcDatabase MAY ( olcHidde n $ olcSuffix $ olcSubordinate $ olcAccess $ olcAddContentAcl $ olcLastMod $ olcLimits $ olcMaxDerefDepth $ olcPlugin $ olcReadOnly $ olcReplica $ olcRepl icaArgsFile $ olcReplicaPidFile $ olcReplicationInterval $ olcReplogFile $ ol cRequires $ olcRestrict $ olcRootDN $ olcRootPW $ olcSchemaDN $ olcSecurity $ olcSizeLimit $ olcSyncUseSubentry $ olcSyncrepl $ olcTimeLimit $ olcUpdateDN $ olcUpdateRef $ olcMirrorMode $ olcMonitoring $ olcExtraAttrs ) ) olcObjectClasses: ( OLcfgGlOc:5 NAME 'olcOverlayConfig' DESC 'OpenLDAP Overlay -specific options' SUP olcConfig STRUCTURAL MUST olcOverlay ) olcObjectClasses: ( OLcfgGlOc:6 NAME 'olcIncludeFile' DESC 'OpenLDAP configura tion include file' SUP olcConfig STRUCTURAL MUST olcInclude MAY ( cn $ olcRoo tDSE ) ) olcObjectClasses: ( OLcfgGlOc:7 NAME 'olcFrontendConfig' DESC 'OpenLDAP fronte nd configuration' AUXILIARY MAY ( olcDefaultSearchBase $ olcPasswordHash $ ol cSortVals ) ) olcObjectClasses: ( OLcfgGlOc:8 NAME 'olcModuleList' DESC 'OpenLDAP dynamic mo dule info' SUP olcConfig STRUCTURAL MAY ( cn $ olcModulePath $ olcModuleLoad ) ) olcObjectClasses: ( OLcfgDbOc:2.1 NAME 'olcLdifConfig' DESC 'LDIF backend conf iguration' SUP olcDatabaseConfig STRUCTURAL MUST olcDbDirectory ) olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.1 NAME 'monitor' DESC 'OpenLDAP system monitoring' SUP top STRUCTURAL MUST cn MAY ( description $ seeAlso $ l abeledURI $ monitoredInfo $ managedInfo $ monitorOverlay ) ) olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.2 NAME 'monitorServer' DESC 'Ser ver monitoring root entry' SUP monitor STRUCTURAL ) olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.3 NAME 'monitorContainer' DESC ' monitor container class' SUP monitor STRUCTURAL ) olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.4 NAME 'monitorCounterObject' DE SC 'monitor counter class' SUP monitor STRUCTURAL ) olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.5 NAME 'monitorOperation' DESC ' monitor operation class' SUP monitor STRUCTURAL ) olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.6 NAME 'monitorConnection' DESC 'monitor connection class' SUP monitor STRUCTURAL ) olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.7 NAME 'managedObject' DESC 'mon itor managed entity class' SUP monitor STRUCTURAL ) olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.8 NAME 'monitoredObject' DESC 'm onitor monitored entity class' SUP monitor STRUCTURAL ) olcObjectClasses: ( OLcfgDbOc:4.1 NAME 'olcMonitorConfig' DESC 'Monitor backen d configuration' SUP olcDatabaseConfig STRUCTURAL ) olcObjectClasses: ( OLcfgDbOc:1.1 NAME 'olcBdbConfig' DESC 'BDB backend config uration' SUP olcDatabaseConfig STRUCTURAL MUST olcDbDirectory MAY ( olcDbCach eSize $ olcDbCheckpoint $ olcDbChecksum $ olcDbConfig $ olcDbCryptFile $ olcD bCryptKey $ olcDbNoSync $ olcDbDirtyRead $ olcDbIDLcacheSize $ olcDbIndex $ o lcDbLinearIndex $ olcDbLockDetect $ olcDbMode $ olcDbSearchStack $ olcDbShmKe y $ olcDbCacheFree $ olcDbDNcacheSize $ olcDbPageSize ) ) olcObjectClasses: ( OLcfgDbOc:1.2 NAME 'olcHdbConfig' DESC 'HDB backend config uration' SUP olcDatabaseConfig STRUCTURAL MUST olcDbDirectory MAY ( olcDbCach eSize $ olcDbCheckpoint $ olcDbChecksum $ olcDbConfig $ olcDbCryptFile $ olcD bCryptKey $ olcDbNoSync $ olcDbDirtyRead $ olcDbIDLcacheSize $ olcDbIndex $ o lcDbLinearIndex $ olcDbLockDetect $ olcDbMode $ olcDbSearchStack $ olcDbShmKe y $ olcDbCacheFree $ olcDbDNcacheSize $ olcDbPageSize ) ) olcObjectClasses: ( OLcfgDbOc:12.1 NAME 'olcMdbConfig' DESC 'MDB backend confi guration' SUP olcDatabaseConfig STRUCTURAL MUST olcDbDirectory MAY ( olcDbChe ckpoint $ olcDbEnvFlags $ olcDbNoSync $ olcDbIndex $ olcDbMaxReaders $ olcDbM axSize $ olcDbMode $ olcDbSearchStack $ olcDbRtxnSize ) ) olcObjectClasses: ( OLcfgOvOc:1.1 NAME 'olcSyncProvConfig' DESC 'SyncRepl Prov ider configuration' SUP olcOverlayConfig STRUCTURAL MAY ( olcSpCheckpoint $ o lcSpSessionlog $ olcSpNoPresent $ olcSpReloadHint ) ) olcObjectClasses: ( olmBDBObjectClasses:1 NAME 'olmBDBDatabase' SUP top AUXILI ARY MAY ( olmBDBEntryCache $ olmBDBDNCache $ olmBDBIDLCache $ olmDbDirectory ) ) olcObjectClasses: ( OLcfgOvOc:12.1 NAME 'olcPPolicyConfig' DESC 'Password Poli cy configuration' SUP olcOverlayConfig STRUCTURAL MAY ( olcPPolicyDefault $ o lcPPolicyHashCleartext $ olcPPolicyUseLockout $ olcPPolicyForwardUpdates ) ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.1 DESC 'ACI Item' X-BINARY-TRANS FER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.2 DESC 'Access Point' X-NOT-HUMA N-READABLE 'TRUE' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.3 DESC 'Attribute Type Descripti on' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.4 DESC 'Audio' X-NOT-HUMAN-READA BLE 'TRUE' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.5 DESC 'Binary' X-NOT-HUMAN-READ ABLE 'TRUE' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.6 DESC 'Bit String' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.7 DESC 'Boolean' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.8 DESC 'Certificate' X-BINARY-TR ANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.9 DESC 'Certificate List' X-BINA RY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.10 DESC 'Certificate Pair' X-BIN ARY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.10.2.1 DESC 'X.509 AttributeCertifi cate' X-BINARY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.12 DESC 'Distinguished Name' ) olcLdapSyntaxes: ( 1.2.36.79672281.1.5.0 DESC 'RDN' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.13 DESC 'Data Quality' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.14 DESC 'Delivery Method' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.15 DESC 'Directory String' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.16 DESC 'DIT Content Rule Descri ption' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.17 DESC 'DIT Structure Rule Desc ription' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.19 DESC 'DSA Quality' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.20 DESC 'DSE Type' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.21 DESC 'Enhanced Guide' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.22 DESC 'Facsimile Telephone Num ber' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.23 DESC 'Fax' X-NOT-HUMAN-READAB LE 'TRUE' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.24 DESC 'Generalized Time' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.25 DESC 'Guide' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.26 DESC 'IA5 String' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.27 DESC 'Integer' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.28 DESC 'JPEG' X-NOT-HUMAN-READA BLE 'TRUE' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.29 DESC 'Master And Shadow Acces s Points' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.30 DESC 'Matching Rule Descripti on' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.31 DESC 'Matching Rule Use Descr iption' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.32 DESC 'Mail Preference' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.33 DESC 'MHS OR Address' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.34 DESC 'Name And Optional UID' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.35 DESC 'Name Form Description' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.36 DESC 'Numeric String' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.37 DESC 'Object Class Descriptio n' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.38 DESC 'OID' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.39 DESC 'Other Mailbox' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.40 DESC 'Octet String' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.41 DESC 'Postal Address' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.42 DESC 'Protocol Information' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.43 DESC 'Presentation Address' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.44 DESC 'Printable String' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.11 DESC 'Country String' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.45 DESC 'SubtreeSpecification' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.49 DESC 'Supported Algorithm' X- BINARY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.50 DESC 'Telephone Number' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.51 DESC 'Teletex Terminal Identi fier' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.52 DESC 'Telex Number' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.54 DESC 'LDAP Syntax Description ' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.55 DESC 'Modify Rights' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.56 DESC 'LDAP Schema Definition' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.57 DESC 'LDAP Schema Description ' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.58 DESC 'Substring Assertion' ) olcLdapSyntaxes: ( 1.3.6.1.1.1.0.0 DESC 'RFC2307 NIS Netgroup Triple' ) olcLdapSyntaxes: ( 1.3.6.1.1.1.0.1 DESC 'RFC2307 Boot Parameter' ) olcLdapSyntaxes: ( 1.3.6.1.1.15.1 DESC 'Certificate Exact Assertion' ) olcLdapSyntaxes: ( 1.3.6.1.1.15.2 DESC 'Certificate Assertion' ) olcLdapSyntaxes: ( 1.3.6.1.1.15.3 DESC 'Certificate Pair Exact Assertion' ) olcLdapSyntaxes: ( 1.3.6.1.1.15.4 DESC 'Certificate Pair Assertion' ) olcLdapSyntaxes: ( 1.3.6.1.1.15.5 DESC 'Certificate List Exact Assertion' ) olcLdapSyntaxes: ( 1.3.6.1.1.15.6 DESC 'Certificate List Assertion' ) olcLdapSyntaxes: ( 1.3.6.1.1.15.7 DESC 'Algorithm Identifier' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.10.2.2 DESC 'AttributeCertificate E xact Assertion' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.10.2.3 DESC 'AttributeCertificate A ssertion' ) olcLdapSyntaxes: ( 1.3.6.1.1.16.1 DESC 'UUID' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.2.1 DESC 'CSN' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.2.4 DESC 'CSN SID' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.1.1.1 DESC 'OpenLDAP void' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.2.7 DESC 'OpenLDAP authz' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.2.1 DESC 'OpenLDAP Experimental ACI' ) # {0}core, schema, config dn: cn={0}core,cn=schema,cn=config objectClass: olcSchemaConfig cn: {0}core olcAttributeTypes: {0}( 2.5.4.2 NAME 'knowledgeInformation' DESC 'RFC2256: kno wledge information' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121. 1.15{32768} ) olcAttributeTypes: {1}( 2.5.4.4 NAME ( 'sn' 'surname' ) DESC 'RFC2256: last (f amily) name(s) for which the entity is known by' SUP name ) olcAttributeTypes: {2}( 2.5.4.5 NAME 'serialNumber' DESC 'RFC2256: serial numb er of the entity' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch S YNTAX 1.3.6.1.4.1.1466.115.121.1.44{64} ) olcAttributeTypes: {3}( 2.5.4.6 NAME ( 'c' 'countryName' ) DESC 'RFC4519: two- letter ISO-3166 country code' SUP name SYNTAX 1.3.6.1.4.1.1466.115.121.1.11 S INGLE-VALUE ) olcAttributeTypes: {4}( 2.5.4.7 NAME ( 'l' 'localityName' ) DESC 'RFC2256: loc ality which this object resides in' SUP name ) olcAttributeTypes: {5}( 2.5.4.8 NAME ( 'st' 'stateOrProvinceName' ) DESC 'RFC2 256: state or province which this object resides in' SUP name ) olcAttributeTypes: {6}( 2.5.4.9 NAME ( 'street' 'streetAddress' ) DESC 'RFC225 6: street address of this object' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreS ubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) olcAttributeTypes: {7}( 2.5.4.10 NAME ( 'o' 'organizationName' ) DESC 'RFC2256 : organization this object belongs to' SUP name ) olcAttributeTypes: {8}( 2.5.4.11 NAME ( 'ou' 'organizationalUnitName' ) DESC ' RFC2256: organizational unit this object belongs to' SUP name ) olcAttributeTypes: {9}( 2.5.4.12 NAME 'title' DESC 'RFC2256: title associated with the entity' SUP name ) olcAttributeTypes: {10}( 2.5.4.14 NAME 'searchGuide' DESC 'RFC2256: search gui de, deprecated by enhancedSearchGuide' SYNTAX 1.3.6.1.4.1.1466.115.121.1.25 ) olcAttributeTypes: {11}( 2.5.4.15 NAME 'businessCategory' DESC 'RFC2256: busin ess category' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTA X 1.3.6.1.4.1.1466.115.121.1.15{128} ) olcAttributeTypes: {12}( 2.5.4.16 NAME 'postalAddress' DESC 'RFC2256: postal a ddress' EQUALITY caseIgnoreListMatch SUBSTR caseIgnoreListSubstringsMatch SYN TAX 1.3.6.1.4.1.1466.115.121.1.41 ) olcAttributeTypes: {13}( 2.5.4.17 NAME 'postalCode' DESC 'RFC2256: postal code ' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4. 1.1466.115.121.1.15{40} ) olcAttributeTypes: {14}( 2.5.4.18 NAME 'postOfficeBox' DESC 'RFC2256: Post Off ice Box' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3 .6.1.4.1.1466.115.121.1.15{40} ) olcAttributeTypes: {15}( 2.5.4.19 NAME 'physicalDeliveryOfficeName' DESC 'RFC2 256: Physical Delivery Office Name' EQUALITY caseIgnoreMatch SUBSTR caseIgnor eSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) olcAttributeTypes: {16}( 2.5.4.20 NAME 'telephoneNumber' DESC 'RFC2256: Teleph one Number' EQUALITY telephoneNumberMatch SUBSTR telephoneNumberSubstringsMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.50{32} ) olcAttributeTypes: {17}( 2.5.4.21 NAME 'telexNumber' DESC 'RFC2256: Telex Numb er' SYNTAX 1.3.6.1.4.1.1466.115.121.1.52 ) olcAttributeTypes: {18}( 2.5.4.22 NAME 'teletexTerminalIdentifier' DESC 'RFC22 56: Teletex Terminal Identifier' SYNTAX 1.3.6.1.4.1.1466.115.121.1.51 ) olcAttributeTypes: {19}( 2.5.4.23 NAME ( 'facsimileTelephoneNumber' 'fax' ) DE SC 'RFC2256: Facsimile (Fax) Telephone Number' SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.22 ) olcAttributeTypes: {20}( 2.5.4.24 NAME 'x121Address' DESC 'RFC2256: X.121 Addr ess' EQUALITY numericStringMatch SUBSTR numericStringSubstringsMatch SYNTAX 1 .3.6.1.4.1.1466.115.121.1.36{15} ) olcAttributeTypes: {21}( 2.5.4.25 NAME 'internationaliSDNNumber' DESC 'RFC2256 : international ISDN number' EQUALITY numericStringMatch SUBSTR numericString SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.36{16} ) olcAttributeTypes: {22}( 2.5.4.26 NAME 'registeredAddress' DESC 'RFC2256: regi stered postal address' SUP postalAddress SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 ) olcAttributeTypes: {23}( 2.5.4.27 NAME 'destinationIndicator' DESC 'RFC2256: d estination indicator' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44{128} ) olcAttributeTypes: {24}( 2.5.4.28 NAME 'preferredDeliveryMethod' DESC 'RFC2256 : preferred delivery method' SYNTAX 1.3.6.1.4.1.1466.115.121.1.14 SINGLE-VALU E ) olcAttributeTypes: {25}( 2.5.4.29 NAME 'presentationAddress' DESC 'RFC2256: pr esentation address' EQUALITY presentationAddressMatch SYNTAX 1.3.6.1.4.1.1466 .115.121.1.43 SINGLE-VALUE ) olcAttributeTypes: {26}( 2.5.4.30 NAME 'supportedApplicationContext' DESC 'RFC 2256: supported application context' EQUALITY objectIdentifierMatch SYNTAX 1. 3.6.1.4.1.1466.115.121.1.38 ) olcAttributeTypes: {27}( 2.5.4.31 NAME 'member' DESC 'RFC2256: member of a gro up' SUP distinguishedName ) olcAttributeTypes: {28}( 2.5.4.32 NAME 'owner' DESC 'RFC2256: owner (of the ob ject)' SUP distinguishedName ) olcAttributeTypes: {29}( 2.5.4.33 NAME 'roleOccupant' DESC 'RFC2256: occupant of role' SUP distinguishedName ) olcAttributeTypes: {30}( 2.5.4.36 NAME 'userCertificate' DESC 'RFC2256: X.509 user certificate, use ;binary' EQUALITY certificateExactMatch SYNTAX 1.3.6.1. 4.1.1466.115.121.1.8 ) olcAttributeTypes: {31}( 2.5.4.37 NAME 'cACertificate' DESC 'RFC2256: X.509 CA certificate, use ;binary' EQUALITY certificateExactMatch SYNTAX 1.3.6.1.4.1. 1466.115.121.1.8 ) olcAttributeTypes: {32}( 2.5.4.38 NAME 'authorityRevocationList' DESC 'RFC2256 : X.509 authority revocation list, use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.1 21.1.9 ) olcAttributeTypes: {33}( 2.5.4.39 NAME 'certificateRevocationList' DESC 'RFC22 56: X.509 certificate revocation list, use ;binary' SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.9 ) olcAttributeTypes: {34}( 2.5.4.40 NAME 'crossCertificatePair' DESC 'RFC2256: X .509 cross certificate pair, use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.121.1.1 0 ) olcAttributeTypes: {35}( 2.5.4.42 NAME ( 'givenName' 'gn' ) DESC 'RFC2256: fir st name(s) for which the entity is known by' SUP name ) olcAttributeTypes: {36}( 2.5.4.43 NAME 'initials' DESC 'RFC2256: initials of s ome or all of names, but not the surname(s).' SUP name ) olcAttributeTypes: {37}( 2.5.4.44 NAME 'generationQualifier' DESC 'RFC2256: na me qualifier indicating a generation' SUP name ) olcAttributeTypes: {38}( 2.5.4.45 NAME 'x500UniqueIdentifier' DESC 'RFC2256: X .500 unique identifier' EQUALITY bitStringMatch SYNTAX 1.3.6.1.4.1.1466.115.1 21.1.6 ) olcAttributeTypes: {39}( 2.5.4.46 NAME 'dnQualifier' DESC 'RFC2256: DN qualifi er' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgno reSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44 ) olcAttributeTypes: {40}( 2.5.4.47 NAME 'enhancedSearchGuide' DESC 'RFC2256: en hanced search guide' SYNTAX 1.3.6.1.4.1.1466.115.121.1.21 ) olcAttributeTypes: {41}( 2.5.4.48 NAME 'protocolInformation' DESC 'RFC2256: pr otocol information' EQUALITY protocolInformationMatch SYNTAX 1.3.6.1.4.1.1466 .115.121.1.42 ) olcAttributeTypes: {42}( 2.5.4.50 NAME 'uniqueMember' DESC 'RFC2256: unique me mber of a group' EQUALITY uniqueMemberMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1 .34 ) olcAttributeTypes: {43}( 2.5.4.51 NAME 'houseIdentifier' DESC 'RFC2256: house identifier' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) olcAttributeTypes: {44}( 2.5.4.52 NAME 'supportedAlgorithms' DESC 'RFC2256: su pported algorithms' SYNTAX 1.3.6.1.4.1.1466.115.121.1.49 ) olcAttributeTypes: {45}( 2.5.4.53 NAME 'deltaRevocationList' DESC 'RFC2256: de lta revocation list; use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.121.1.9 ) olcAttributeTypes: {46}( 2.5.4.54 NAME 'dmdName' DESC 'RFC2256: name of DMD' S UP name ) olcAttributeTypes: {47}( 2.5.4.65 NAME 'pseudonym' DESC 'X.520(4th): pseudonym for the object' SUP name ) olcAttributeTypes: {48}( 0.9.2342.19200300.100.1.3 NAME ( 'mail' 'rfc822Mailbo x' ) DESC 'RFC1274: RFC822 Mailbox' EQUALITY caseIgnoreIA5Match SUBSTR ca seIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) olcAttributeTypes: {49}( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domainCompone nt' ) DESC 'RFC1274/2247: domain component' EQUALITY caseIgnoreIA5Match SUBST R caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VA LUE ) olcAttributeTypes: {50}( 0.9.2342.19200300.100.1.37 NAME 'associatedDomain' DE SC 'RFC1274: domain associated with object' EQUALITY caseIgnoreIA5Match SUBST R caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {51}( 1.2.840.113549.1.9.1 NAME ( 'email' 'emailAddress' 'p kcs9email' ) DESC 'RFC3280: legacy attribute for email addresses in DNs' EQUA LITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4. 1.1466.115.121.1.26{128} ) olcObjectClasses: {0}( 2.5.6.2 NAME 'country' DESC 'RFC2256: a country' SUP to p STRUCTURAL MUST c MAY ( searchGuide $ description ) ) olcObjectClasses: {1}( 2.5.6.3 NAME 'locality' DESC 'RFC2256: a locality' SUP top STRUCTURAL MAY ( street $ seeAlso $ searchGuide $ st $ l $ description ) ) olcObjectClasses: {2}( 2.5.6.4 NAME 'organization' DESC 'RFC2256: an organizat ion' SUP top STRUCTURAL MUST o MAY ( userPassword $ searchGuide $ seeAlso $ b usinessCategory $ x121Address $ registeredAddress $ destinationIndicator $ pr eferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNu mber $ internationaliSDNNumber $ facsimileTelephoneNumber $ street $ postOff iceBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ st $ l $ d escription ) ) olcObjectClasses: {3}( 2.5.6.5 NAME 'organizationalUnit' DESC 'RFC2256: an org anizational unit' SUP top STRUCTURAL MUST ou MAY ( userPassword $ searchGuide $ seeAlso $ businessCategory $ x121Address $ registeredAddress $ destination Indicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $ facsimileTelephoneNumber $ str eet $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ st $ l $ description ) ) olcObjectClasses: {4}( 2.5.6.6 NAME 'person' DESC 'RFC2256: a person' SUP top STRUCTURAL MUST ( sn $ cn ) MAY ( userPassword $ telephoneNumber $ seeAlso $ description ) ) olcObjectClasses: {5}( 2.5.6.7 NAME 'organizationalPerson' DESC 'RFC2256: an o rganizational person' SUP person STRUCTURAL MAY ( title $ x121Address $ regis teredAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $ fac simileTelephoneNumber $ street $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ ou $ st $ l ) ) olcObjectClasses: {6}( 2.5.6.8 NAME 'organizationalRole' DESC 'RFC2256: an org anizational role' SUP top STRUCTURAL MUST cn MAY ( x121Address $ registeredAd dress $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $ telete xTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $ facsimileTe lephoneNumber $ seeAlso $ roleOccupant $ preferredDeliveryMethod $ street $ p ostOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ ou $ st $ l $ description ) ) olcObjectClasses: {7}( 2.5.6.9 NAME 'groupOfNames' DESC 'RFC2256: a group of n ames (DNs)' SUP top STRUCTURAL MUST ( member $ cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description ) ) olcObjectClasses: {8}( 2.5.6.10 NAME 'residentialPerson' DESC 'RFC2256: an res idential person' SUP person STRUCTURAL MUST l MAY ( businessCategory $ x121Ad dress $ registeredAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDN Number $ facsimileTelephoneNumber $ preferredDeliveryMethod $ street $ postOf ficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ st $ l ) ) olcObjectClasses: {9}( 2.5.6.11 NAME 'applicationProcess' DESC 'RFC2256: an ap plication process' SUP top STRUCTURAL MUST cn MAY ( seeAlso $ ou $ l $ descri ption ) ) olcObjectClasses: {10}( 2.5.6.12 NAME 'applicationEntity' DESC 'RFC2256: an ap plication entity' SUP top STRUCTURAL MUST ( presentationAddress $ cn ) MAY ( supportedApplicationContext $ seeAlso $ ou $ o $ l $ description ) ) olcObjectClasses: {11}( 2.5.6.13 NAME 'dSA' DESC 'RFC2256: a directory system agent (a server)' SUP applicationEntity STRUCTURAL MAY knowledgeInformation ) olcObjectClasses: {12}( 2.5.6.14 NAME 'device' DESC 'RFC2256: a device' SUP to p STRUCTURAL MUST cn MAY ( serialNumber $ seeAlso $ owner $ ou $ o $ l $ desc ription ) ) olcObjectClasses: {13}( 2.5.6.15 NAME 'strongAuthenticationUser' DESC 'RFC2256 : a strong authentication user' SUP top AUXILIARY MUST userCertificate ) olcObjectClasses: {14}( 2.5.6.16 NAME 'certificationAuthority' DESC 'RFC2256: a certificate authority' SUP top AUXILIARY MUST ( authorityRevocationList $ c ertificateRevocationList $ cACertificate ) MAY crossCertificatePair ) olcObjectClasses: {15}( 2.5.6.17 NAME 'groupOfUniqueNames' DESC 'RFC2256: a gr oup of unique names (DN and Unique Identifier)' SUP top STRUCTURAL MUST ( uni queMember $ cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ descript ion ) ) olcObjectClasses: {16}( 2.5.6.18 NAME 'userSecurityInformation' DESC 'RFC2256: a user security information' SUP top AUXILIARY MAY ( supportedAlgorithms ) ) olcObjectClasses: {17}( 2.5.6.16.2 NAME 'certificationAuthority-V2' SUP certif icationAuthority AUXILIARY MAY ( deltaRevocationList ) ) olcObjectClasses: {18}( 2.5.6.19 NAME 'cRLDistributionPoint' SUP top STRUCTURA L MUST ( cn ) MAY ( certificateRevocationList $ authorityRevocationList $ del taRevocationList ) ) olcObjectClasses: {19}( 2.5.6.20 NAME 'dmd' SUP top STRUCTURAL MUST ( dmdName ) MAY ( userPassword $ searchGuide $ seeAlso $ businessCategory $ x121Address $ registeredAddress $ destinationIndicator $ preferredDeliveryMethod $ telex Number $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumbe r $ facsimileTelephoneNumber $ street $ postOfficeBox $ postalCode $ postalAd dress $ physicalDeliveryOfficeName $ st $ l $ description ) ) olcObjectClasses: {20}( 2.5.6.21 NAME 'pkiUser' DESC 'RFC2587: a PKI user' SUP top AUXILIARY MAY userCertificate ) olcObjectClasses: {21}( 2.5.6.22 NAME 'pkiCA' DESC 'RFC2587: PKI certificate a uthority' SUP top AUXILIARY MAY ( authorityRevocationList $ certificateRevoca tionList $ cACertificate $ crossCertificatePair ) ) olcObjectClasses: {22}( 2.5.6.23 NAME 'deltaCRL' DESC 'RFC2587: PKI user' SUP top AUXILIARY MAY deltaRevocationList ) olcObjectClasses: {23}( 1.3.6.1.4.1.250.3.15 NAME 'labeledURIObject' DESC 'RFC 2079: object that contains the URI attribute type' MAY ( labeledURI ) SUP top AUXILIARY ) olcObjectClasses: {24}( 0.9.2342.19200300.100.4.19 NAME 'simpleSecurityObject' DESC 'RFC1274: simple security object' SUP top AUXILIARY MUST userPassword ) olcObjectClasses: {25}( 1.3.6.1.4.1.1466.344 NAME 'dcObject' DESC 'RFC2247: do main component object' SUP top AUXILIARY MUST dc ) olcObjectClasses: {26}( 1.3.6.1.1.3.1 NAME 'uidObject' DESC 'RFC2377: uid obje ct' SUP top AUXILIARY MUST uid ) # {1}cosine, schema, config dn: cn={1}cosine,cn=schema,cn=config objectClass: olcSchemaConfig cn: {1}cosine olcAttributeTypes: {0}( 0.9.2342.19200300.100.1.2 NAME 'textEncodedORAddress' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1. 1466.115.121.1.15{256} ) olcAttributeTypes: {1}( 0.9.2342.19200300.100.1.4 NAME 'info' DESC 'RFC1274: g eneral information' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{2048} ) olcAttributeTypes: {2}( 0.9.2342.19200300.100.1.5 NAME ( 'drink' 'favouriteDri nk' ) DESC 'RFC1274: favorite drink' EQUALITY caseIgnoreMatch SUBSTR caseIgno reSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {3}( 0.9.2342.19200300.100.1.6 NAME 'roomNumber' DESC 'RFC1 274: room number' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch S YNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {4}( 0.9.2342.19200300.100.1.7 NAME 'photo' DESC 'RFC1274: photo (G3 fax)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.23{25000} ) olcAttributeTypes: {5}( 0.9.2342.19200300.100.1.8 NAME 'userClass' DESC 'RFC12 74: category of user' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {6}( 0.9.2342.19200300.100.1.9 NAME 'host' DESC 'RFC1274: h ost computer' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTA X 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {7}( 0.9.2342.19200300.100.1.10 NAME 'manager' DESC 'RFC127 4: DN of manager' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115 .121.1.12 ) olcAttributeTypes: {8}( 0.9.2342.19200300.100.1.11 NAME 'documentIdentifier' D ESC 'RFC1274: unique identifier of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {9}( 0.9.2342.19200300.100.1.12 NAME 'documentTitle' DESC ' RFC1274: title of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstri ngsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {10}( 0.9.2342.19200300.100.1.13 NAME 'documentVersion' DES C 'RFC1274: version of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSu bstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {11}( 0.9.2342.19200300.100.1.14 NAME 'documentAuthor' DESC 'RFC1274: DN of author of document' EQUALITY distinguishedNameMatch SYNTAX 1 .3.6.1.4.1.1466.115.121.1.12 ) olcAttributeTypes: {12}( 0.9.2342.19200300.100.1.15 NAME 'documentLocation' DE SC 'RFC1274: location of document original' EQUALITY caseIgnoreMatch SUBSTR c aseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {13}( 0.9.2342.19200300.100.1.20 NAME ( 'homePhone' 'homeTe lephoneNumber' ) DESC 'RFC1274: home telephone number' EQUALITY telephoneNumb erMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121 .1.50 ) olcAttributeTypes: {14}( 0.9.2342.19200300.100.1.21 NAME 'secretary' DESC 'RFC 1274: DN of secretary' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.146 6.115.121.1.12 ) olcAttributeTypes: {15}( 0.9.2342.19200300.100.1.22 NAME 'otherMailbox' SYNTAX 1.3.6.1.4.1.1466.115.121.1.39 ) olcAttributeTypes: {16}( 0.9.2342.19200300.100.1.26 NAME 'aRecord' EQUALITY ca seIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {17}( 0.9.2342.19200300.100.1.27 NAME 'mDRecord' EQUALITY c aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {18}( 0.9.2342.19200300.100.1.28 NAME 'mXRecord' EQUALITY c aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {19}( 0.9.2342.19200300.100.1.29 NAME 'nSRecord' EQUALITY c aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {20}( 0.9.2342.19200300.100.1.30 NAME 'sOARecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {21}( 0.9.2342.19200300.100.1.31 NAME 'cNAMERecord' EQUALIT Y caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {22}( 0.9.2342.19200300.100.1.38 NAME 'associatedName' DESC 'RFC1274: DN of entry associated with domain' EQUALITY distinguishedNameMatc h SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 ) olcAttributeTypes: {23}( 0.9.2342.19200300.100.1.39 NAME 'homePostalAddress' D ESC 'RFC1274: home postal address' EQUALITY caseIgnoreListMatch SUBSTR caseIg noreListSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 ) olcAttributeTypes: {24}( 0.9.2342.19200300.100.1.40 NAME 'personalTitle' DESC 'RFC1274: personal title' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstring sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {25}( 0.9.2342.19200300.100.1.41 NAME ( 'mobile' 'mobileTel ephoneNumber' ) DESC 'RFC1274: mobile telephone number' EQUALITY telephoneNum berMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.50 ) olcAttributeTypes: {26}( 0.9.2342.19200300.100.1.42 NAME ( 'pager' 'pagerTelep honeNumber' ) DESC 'RFC1274: pager telephone number' EQUALITY telephoneNumber Match SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1 .50 ) olcAttributeTypes: {27}( 0.9.2342.19200300.100.1.43 NAME ( 'co' 'friendlyCount ryName' ) DESC 'RFC1274: friendly country name' EQUALITY caseIgnoreMatch SUBS TR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {28}( 0.9.2342.19200300.100.1.44 NAME 'uniqueIdentifier' DE SC 'RFC1274: unique identifer' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.14 66.115.121.1.15{256} ) olcAttributeTypes: {29}( 0.9.2342.19200300.100.1.45 NAME 'organizationalStatus ' DESC 'RFC1274: organizational status' EQUALITY caseIgnoreMatch SUBSTR caseI gnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {30}( 0.9.2342.19200300.100.1.46 NAME 'janetMailbox' DESC ' RFC1274: Janet mailbox' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Subst ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) olcAttributeTypes: {31}( 0.9.2342.19200300.100.1.47 NAME 'mailPreferenceOption ' DESC 'RFC1274: mail preference option' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) olcAttributeTypes: {32}( 0.9.2342.19200300.100.1.48 NAME 'buildingName' DESC ' RFC1274: name of building' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstrin gsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {33}( 0.9.2342.19200300.100.1.49 NAME 'dSAQuality' DESC 'RF C1274: DSA Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.19 SINGLE-VALUE ) olcAttributeTypes: {34}( 0.9.2342.19200300.100.1.50 NAME 'singleLevelQuality' DESC 'RFC1274: Single Level Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.13 SIN GLE-VALUE ) olcAttributeTypes: {35}( 0.9.2342.19200300.100.1.51 NAME 'subtreeMinimumQualit y' DESC 'RFC1274: Subtree Mininum Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1. 13 SINGLE-VALUE ) olcAttributeTypes: {36}( 0.9.2342.19200300.100.1.52 NAME 'subtreeMaximumQualit y' DESC 'RFC1274: Subtree Maximun Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1. 13 SINGLE-VALUE ) olcAttributeTypes: {37}( 0.9.2342.19200300.100.1.53 NAME 'personalSignature' D ESC 'RFC1274: Personal Signature (G3 fax)' SYNTAX 1.3.6.1.4.1.1466.115.121.1. 23 ) olcAttributeTypes: {38}( 0.9.2342.19200300.100.1.54 NAME 'dITRedirect' DESC 'R FC1274: DIT Redirect' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466 .115.121.1.12 ) olcAttributeTypes: {39}( 0.9.2342.19200300.100.1.55 NAME 'audio' DESC 'RFC1274 : audio (u-law)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.4{25000} ) olcAttributeTypes: {40}( 0.9.2342.19200300.100.1.56 NAME 'documentPublisher' D ESC 'RFC1274: publisher of document' EQUALITY caseIgnoreMatch SUBSTR caseIgno reSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcObjectClasses: {0}( 0.9.2342.19200300.100.4.4 NAME ( 'pilotPerson' 'newPilo tPerson' ) SUP person STRUCTURAL MAY ( userid $ textEncodedORAddress $ rfc822 Mailbox $ favouriteDrink $ roomNumber $ userClass $ homeTelephoneNumber $ hom ePostalAddress $ secretary $ personalTitle $ preferredDeliveryMethod $ busine ssCategory $ janetMailbox $ otherMailbox $ mobileTelephoneNumber $ pagerTelep honeNumber $ organizationalStatus $ mailPreferenceOption $ personalSignature ) ) olcObjectClasses: {1}( 0.9.2342.19200300.100.4.5 NAME 'account' SUP top STRUCT URAL MUST userid MAY ( description $ seeAlso $ localityName $ organizationNam e $ organizationalUnitName $ host ) ) olcObjectClasses: {2}( 0.9.2342.19200300.100.4.6 NAME 'document' SUP top STRUC TURAL MUST documentIdentifier MAY ( commonName $ description $ seeAlso $ loca lityName $ organizationName $ organizationalUnitName $ documentTitle $ docume ntVersion $ documentAuthor $ documentLocation $ documentPublisher ) ) olcObjectClasses: {3}( 0.9.2342.19200300.100.4.7 NAME 'room' SUP top STRUCTURA L MUST commonName MAY ( roomNumber $ description $ seeAlso $ telephoneNumber ) ) olcObjectClasses: {4}( 0.9.2342.19200300.100.4.9 NAME 'documentSeries' SUP top STRUCTURAL MUST commonName MAY ( description $ seeAlso $ telephonenumber $ l ocalityName $ organizationName $ organizationalUnitName ) ) olcObjectClasses: {5}( 0.9.2342.19200300.100.4.13 NAME 'domain' SUP top STRUCT URAL MUST domainComponent MAY ( associatedName $ organizationName $ descripti on $ businessCategory $ seeAlso $ searchGuide $ userPassword $ localityName $ stateOrProvinceName $ streetAddress $ physicalDeliveryOfficeName $ postalAdd ress $ postalCode $ postOfficeBox $ streetAddress $ facsimileTelephoneNumber $ internationalISDNNumber $ telephoneNumber $ teletexTerminalIdentifier $ tel exNumber $ preferredDeliveryMethod $ destinationIndicator $ registeredAddress $ x121Address ) ) olcObjectClasses: {6}( 0.9.2342.19200300.100.4.14 NAME 'RFC822localPart' SUP d omain STRUCTURAL MAY ( commonName $ surname $ description $ seeAlso $ telepho neNumber $ physicalDeliveryOfficeName $ postalAddress $ postalCode $ postOffi ceBox $ streetAddress $ facsimileTelephoneNumber $ internationalISDNNumber $ telephoneNumber $ teletexTerminalIdentifier $ telexNumber $ preferredDelivery Method $ destinationIndicator $ registeredAddress $ x121Address ) ) olcObjectClasses: {7}( 0.9.2342.19200300.100.4.15 NAME 'dNSDomain' SUP domain STRUCTURAL MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAME Record ) ) olcObjectClasses: {8}( 0.9.2342.19200300.100.4.17 NAME 'domainRelatedObject' D ESC 'RFC1274: an object related to an domain' SUP top AUXILIARY MUST associat edDomain ) olcObjectClasses: {9}( 0.9.2342.19200300.100.4.18 NAME 'friendlyCountry' SUP c ountry STRUCTURAL MUST friendlyCountryName ) olcObjectClasses: {10}( 0.9.2342.19200300.100.4.20 NAME 'pilotOrganization' SU P ( organization $ organizationalUnit ) STRUCTURAL MAY buildingName ) olcObjectClasses: {11}( 0.9.2342.19200300.100.4.21 NAME 'pilotDSA' SUP dsa STR UCTURAL MAY dSAQuality ) olcObjectClasses: {12}( 0.9.2342.19200300.100.4.22 NAME 'qualityLabelledData' SUP top AUXILIARY MUST dsaQuality MAY ( subtreeMinimumQuality $ subtreeMaximu mQuality ) ) # {2}inetorgperson, schema, config dn: cn={2}inetorgperson,cn=schema,cn=config objectClass: olcSchemaConfig cn: {2}inetorgperson olcAttributeTypes: {0}( 2.16.840.1.113730.3.1.1 NAME 'carLicense' DESC 'RFC279 8: vehicle license or registration plate' EQUALITY caseIgnoreMatch SUBSTR cas eIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {1}( 2.16.840.1.113730.3.1.2 NAME 'departmentNumber' DESC ' RFC2798: identifies a department within an organization' EQUALITY caseIgnoreM atch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {2}( 2.16.840.1.113730.3.1.241 NAME 'displayName' DESC 'RFC 2798: preferred name to be used when displaying entries' EQUALITY caseIgnoreM atch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SI NGLE-VALUE ) olcAttributeTypes: {3}( 2.16.840.1.113730.3.1.3 NAME 'employeeNumber' DESC 'RF C2798: numerically identifies an employee within an organization' EQUALITY ca seIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.15 SINGLE-VALUE ) olcAttributeTypes: {4}( 2.16.840.1.113730.3.1.4 NAME 'employeeType' DESC 'RFC2 798: type of employment for a person' EQUALITY caseIgnoreMatch SUBSTR caseIgn oreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {5}( 0.9.2342.19200300.100.1.60 NAME 'jpegPhoto' DESC 'RFC2 798: a JPEG image' SYNTAX 1.3.6.1.4.1.1466.115.121.1.28 ) olcAttributeTypes: {6}( 2.16.840.1.113730.3.1.39 NAME 'preferredLanguage' DESC 'RFC2798: preferred written or spoken language for a person' EQUALITY caseIg noreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1. 15 SINGLE-VALUE ) olcAttributeTypes: {7}( 2.16.840.1.113730.3.1.40 NAME 'userSMIMECertificate' D ESC 'RFC2798: PKCS#7 SignedData used to support S/MIME' SYNTAX 1.3.6.1.4.1.14 66.115.121.1.5 ) olcAttributeTypes: {8}( 2.16.840.1.113730.3.1.216 NAME 'userPKCS12' DESC 'RFC2 798: personal identity information, a PKCS #12 PFX' SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.5 ) olcObjectClasses: {0}( 2.16.840.1.113730.3.2.2 NAME 'inetOrgPerson' DESC 'RFC2 798: Internet Organizational Person' SUP organizationalPerson STRUCTURAL MAY( audio $ businessCategory $ carLicense $ departmentNumber $ displayName $ emp loyeeNumber $ employeeType $ givenName $ homePhone $ homePostalAddress $ init ials $ jpegPhoto $ labeledURI $ mail $ manager $ mobile $ o $ pager $ photo$ roomNumber $ secretary $ uid $ userCertificate $ x500uniqueIdentifier $ prefe rredLanguage $ userSMIMECertificate $ userPKCS12 ) ) # {3}nis, schema, config dn: cn={3}nis,cn=schema,cn=config objectClass: olcSchemaConfig cn: {3}nis olcAttributeTypes: {0}( 1.3.6.1.1.1.1.2 NAME 'gecos' DESC 'The GECOS field; th e common name' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatc h SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {1}( 1.3.6.1.1.1.1.3 NAME 'homeDirectory' DESC 'The absolut e path to the home directory' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1 466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {2}( 1.3.6.1.1.1.1.4 NAME 'loginShell' DESC 'The path to th e login shell' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.2 6 SINGLE-VALUE ) olcAttributeTypes: {3}( 1.3.6.1.1.1.1.5 NAME 'shadowLastChange' EQUALITY integ erMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {4}( 1.3.6.1.1.1.1.6 NAME 'shadowMin' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {5}( 1.3.6.1.1.1.1.7 NAME 'shadowMax' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {6}( 1.3.6.1.1.1.1.8 NAME 'shadowWarning' EQUALITY integerM atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {7}( 1.3.6.1.1.1.1.9 NAME 'shadowInactive' EQUALITY integer Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {8}( 1.3.6.1.1.1.1.10 NAME 'shadowExpire' EQUALITY integerM atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {9}( 1.3.6.1.1.1.1.11 NAME 'shadowFlag' EQUALITY integerMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {10}( 1.3.6.1.1.1.1.12 NAME 'memberUid' EQUALITY caseExactI A5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1. 26 ) olcAttributeTypes: {11}( 1.3.6.1.1.1.1.13 NAME 'memberNisNetgroup' EQUALITY ca seExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.11 5.121.1.26 ) olcAttributeTypes: {12}( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple' DESC 'Netgr oup triple' SYNTAX 1.3.6.1.1.1.0.0 ) olcAttributeTypes: {13}( 1.3.6.1.1.1.1.15 NAME 'ipServicePort' EQUALITY intege rMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {14}( 1.3.6.1.1.1.1.16 NAME 'ipServiceProtocol' SUP name ) olcAttributeTypes: {15}( 1.3.6.1.1.1.1.17 NAME 'ipProtocolNumber' EQUALITY int egerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {16}( 1.3.6.1.1.1.1.18 NAME 'oncRpcNumber' EQUALITY integer Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {17}( 1.3.6.1.1.1.1.19 NAME 'ipHostNumber' DESC 'IP address ' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} ) olcAttributeTypes: {18}( 1.3.6.1.1.1.1.20 NAME 'ipNetworkNumber' DESC 'IP netw ork' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} SI NGLE-VALUE ) olcAttributeTypes: {19}( 1.3.6.1.1.1.1.21 NAME 'ipNetmaskNumber' DESC 'IP netm ask' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} SI NGLE-VALUE ) olcAttributeTypes: {20}( 1.3.6.1.1.1.1.22 NAME 'macAddress' DESC 'MAC address' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} ) olcAttributeTypes: {21}( 1.3.6.1.1.1.1.23 NAME 'bootParameter' DESC 'rpc.bootp aramd parameter' SYNTAX 1.3.6.1.1.1.0.1 ) olcAttributeTypes: {22}( 1.3.6.1.1.1.1.24 NAME 'bootFile' DESC 'Boot image nam e' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {23}( 1.3.6.1.1.1.1.26 NAME 'nisMapName' SUP name ) olcAttributeTypes: {24}( 1.3.6.1.1.1.1.27 NAME 'nisMapEntry' EQUALITY caseExac tIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121. 1.26{1024} SINGLE-VALUE ) olcObjectClasses: {0}( 1.3.6.1.1.1.2.0 NAME 'posixAccount' DESC 'Abstraction o f an account with POSIX attributes' SUP top AUXILIARY MUST ( cn $ uid $ uidNu mber $ gidNumber $ homeDirectory ) MAY ( userPassword $ loginShell $ gecos $ description ) ) olcObjectClasses: {1}( 1.3.6.1.1.1.2.1 NAME 'shadowAccount' DESC 'Additional a ttributes for shadow passwords' SUP top AUXILIARY MUST uid MAY ( userPassword $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ description ) ) olcObjectClasses: {2}( 1.3.6.1.1.1.2.2 NAME 'posixGroup' DESC 'Abstraction of a group of accounts' SUP top STRUCTURAL MUST ( cn $ gidNumber ) MAY ( userPas sword $ memberUid $ description ) ) olcObjectClasses: {3}( 1.3.6.1.1.1.2.3 NAME 'ipService' DESC 'Abstraction an I nternet Protocol service' SUP top STRUCTURAL MUST ( cn $ ipServicePort $ ipSe rviceProtocol ) MAY description ) olcObjectClasses: {4}( 1.3.6.1.1.1.2.4 NAME 'ipProtocol' DESC 'Abstraction of an IP protocol' SUP top STRUCTURAL MUST ( cn $ ipProtocolNumber $ description ) MAY description ) olcObjectClasses: {5}( 1.3.6.1.1.1.2.5 NAME 'oncRpc' DESC 'Abstraction of an O NC/RPC binding' SUP top STRUCTURAL MUST ( cn $ oncRpcNumber $ description ) M AY description ) olcObjectClasses: {6}( 1.3.6.1.1.1.2.6 NAME 'ipHost' DESC 'Abstraction of a ho st, an IP device' SUP top AUXILIARY MUST ( cn $ ipHostNumber ) MAY ( l $ desc ription $ manager ) ) olcObjectClasses: {7}( 1.3.6.1.1.1.2.7 NAME 'ipNetwork' DESC 'Abstraction of a n IP network' SUP top STRUCTURAL MUST ( cn $ ipNetworkNumber ) MAY ( ipNetmas kNumber $ l $ description $ manager ) ) olcObjectClasses: {8}( 1.3.6.1.1.1.2.8 NAME 'nisNetgroup' DESC 'Abstraction of a netgroup' SUP top STRUCTURAL MUST cn MAY ( nisNetgroupTriple $ memberNisNe tgroup $ description ) ) olcObjectClasses: {9}( 1.3.6.1.1.1.2.9 NAME 'nisMap' DESC 'A generic abstracti on of a NIS map' SUP top STRUCTURAL MUST nisMapName MAY description ) olcObjectClasses: {10}( 1.3.6.1.1.1.2.10 NAME 'nisObject' DESC 'An entry in a NIS map' SUP top STRUCTURAL MUST ( cn $ nisMapEntry $ nisMapName ) MAY descri ption ) olcObjectClasses: {11}( 1.3.6.1.1.1.2.11 NAME 'ieee802Device' DESC 'A device w ith a MAC address' SUP top AUXILIARY MAY macAddress ) olcObjectClasses: {12}( 1.3.6.1.1.1.2.12 NAME 'bootableDevice' DESC 'A device with boot parameters' SUP top AUXILIARY MAY ( bootFile $ bootParameter ) ) # {4}openssh-lpk, schema, config dn: cn={4}openssh-lpk,cn=schema,cn=config objectClass: olcSchemaConfig cn: {4}openssh-lpk olcAttributeTypes: {0}( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey' DES C 'MANDATORY: OpenSSH Public key' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4. 1.1466.115.121.1.40 ) olcObjectClasses: {0}( 1.3.6.1.4.1.24552.500.1.1.2.0 NAME 'ldapPublicKey' DESC 'MANDATORY: OpenSSH LPK objectclass' SUP top AUXILIARY MUST ( sshPublicKey $ uid ) ) # {5}radius, schema, config dn: cn={5}radius,cn=schema,cn=config objectClass: olcSchemaConfig cn: {5}radius olcAttributeTypes: {0}( 1.3.6.1.4.1.3317.4.3.1.1 NAME 'radiusArapFeatures' DES C '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE- VALUE ) olcAttributeTypes: {1}( 1.3.6.1.4.1.3317.4.3.1.2 NAME 'radiusArapSecurity' DES C '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE- VALUE ) olcAttributeTypes: {2}( 1.3.6.1.4.1.3317.4.3.1.3 NAME 'radiusArapZoneAccess' D ESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGL E-VALUE ) olcAttributeTypes: {3}( 1.3.6.1.4.1.3317.4.3.1.44 NAME 'radiusAuthType' DESC ' checkItem: Auth-Type' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115 .121.1.26 SINGLE-VALUE ) olcAttributeTypes: {4}( 1.3.6.1.4.1.3317.4.3.1.4 NAME 'radiusCallbackId' DESC 'replyItem: Callback-Id' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466. 115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {5}( 1.3.6.1.4.1.3317.4.3.1.5 NAME 'radiusCallbackNumber' D ESC 'replyItem: Callback-Number' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4 .1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {6}( 1.3.6.1.4.1.3317.4.3.1.6 NAME 'radiusCalledStationId' DESC 'checkItem: Called-Station-Id' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6. 1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {7}( 1.3.6.1.4.1.3317.4.3.1.7 NAME 'radiusCallingStationId' DESC 'checkItem: Calling-Station-Id' EQUALITY caseIgnoreIA5Match SYNTAX 1.3. 6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {8}( 1.3.6.1.4.1.3317.4.3.1.8 NAME 'radiusClass' DESC 'repl yItem: Class' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.2 6 ) olcAttributeTypes: {9}( 1.3.6.1.4.1.3317.4.3.1.45 NAME 'radiusClientIPAddress' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SIN GLE-VALUE ) olcAttributeTypes: {10}( 1.3.6.1.4.1.3317.4.3.1.9 NAME 'radiusFilterId' DESC ' replyItem: Filter-Id' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115 .121.1.26 ) olcAttributeTypes: {11}( 1.3.6.1.4.1.3317.4.3.1.10 NAME 'radiusFramedAppleTalk Link' DESC 'replyItem: Framed-AppleTalk-Link' EQUALITY caseIgnoreIA5Match SYN TAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {12}( 1.3.6.1.4.1.3317.4.3.1.11 NAME 'radiusFramedAppleTalk Network' DESC 'replyItem: Framed-AppleTalk-Network' EQUALITY caseIgnoreIA5Mat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {13}( 1.3.6.1.4.1.3317.4.3.1.12 NAME 'radiusFramedAppleTalk Zone' DESC 'replyItem: Framed-AppleTalk-Zone' EQUALITY caseIgnoreIA5Match SYN TAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {14}( 1.3.6.1.4.1.3317.4.3.1.13 NAME 'radiusFramedCompressi on' DESC 'replyItem: Framed-Compression' EQUALITY caseIgnoreIA5Match SYNTAX 1 .3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {15}( 1.3.6.1.4.1.3317.4.3.1.14 NAME 'radiusFramedIPAddress ' DESC 'replyItem: Framed-IP-Address' EQUALITY caseIgnoreIA5Match SYNTAX 1.3. 6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {16}( 1.3.6.1.4.1.3317.4.3.1.15 NAME 'radiusFramedIPNetmask ' DESC 'replyItem: Framed-IP-Netmask' EQUALITY caseIgnoreIA5Match SYNTAX 1.3. 6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {17}( 1.3.6.1.4.1.3317.4.3.1.16 NAME 'radiusFramedIPXNetwor k' DESC 'replyItem: Framed-IPX-Network' EQUALITY caseIgnoreIA5Match SYNTAX 1. 3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {18}( 1.3.6.1.4.1.3317.4.3.1.17 NAME 'radiusFramedMTU' DESC 'replyItem: Framed-MTU' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466. 115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {19}( 1.3.6.1.4.1.3317.4.3.1.18 NAME 'radiusFramedProtocol' DESC 'replyItem: Framed-Protocol' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1 .4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {20}( 1.3.6.1.4.1.3317.4.3.1.19 NAME 'radiusFramedRoute' DE SC 'replyItem: Framed-Route' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1 466.115.121.1.26 ) olcAttributeTypes: {21}( 1.3.6.1.4.1.3317.4.3.1.20 NAME 'radiusFramedRouting' DESC 'replyItem: Framed-Routing' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4 .1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {22}( 1.3.6.1.4.1.3317.4.3.1.46 NAME 'radiusGroupName' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {23}( 1.3.6.1.4.1.3317.4.3.1.47 NAME 'radiusHint' DESC '' E QUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {24}( 1.3.6.1.4.1.3317.4.3.1.48 NAME 'radiusHuntgroupName' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {25}( 1.3.6.1.4.1.3317.4.3.1.21 NAME 'radiusIdleTimeout' DE SC 'replyItem: Idle-Timeout' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1 466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {26}( 1.3.6.1.4.1.3317.4.3.1.22 NAME 'radiusLoginIPHost' DE SC 'replyItem: Login-IP-Host' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1. 1466.115.121.1.26 ) olcAttributeTypes: {27}( 1.3.6.1.4.1.3317.4.3.1.23 NAME 'radiusLoginLATGroup' DESC 'replyItem: Login-LAT-Group' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1. 4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {28}( 1.3.6.1.4.1.3317.4.3.1.24 NAME 'radiusLoginLATNode' D ESC 'replyItem: Login-LAT-Node' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4. 1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {29}( 1.3.6.1.4.1.3317.4.3.1.25 NAME 'radiusLoginLATPort' D ESC 'replyItem: Login-LAT-Port' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4. 1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {30}( 1.3.6.1.4.1.3317.4.3.1.26 NAME 'radiusLoginLATService ' DESC 'replyItem: Login-LAT-Service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3. 6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {31}( 1.3.6.1.4.1.3317.4.3.1.27 NAME 'radiusLoginService' D ESC 'replyItem: Login-Service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1 .1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {32}( 1.3.6.1.4.1.3317.4.3.1.28 NAME 'radiusLoginTCPPort' D ESC 'replyItem: Login-TCP-Port' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4. 1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {33}( 1.3.6.1.4.1.3317.4.3.1.29 NAME 'radiusPasswordRetry' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SING LE-VALUE ) olcAttributeTypes: {34}( 1.3.6.1.4.1.3317.4.3.1.30 NAME 'radiusPortLimit' DESC 'replyItem: Port-Limit' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466. 115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {35}( 1.3.6.1.4.1.3317.4.3.1.49 NAME 'radiusProfileDn' DESC '' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SING LE-VALUE ) olcAttributeTypes: {36}( 1.3.6.1.4.1.3317.4.3.1.31 NAME 'radiusPrompt' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALU E ) olcAttributeTypes: {37}( 1.3.6.1.4.1.3317.4.3.1.50 NAME 'radiusProxyToRealm' D ESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGL E-VALUE ) olcAttributeTypes: {38}( 1.3.6.1.4.1.3317.4.3.1.51 NAME 'radiusReplicateToReal m' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 S INGLE-VALUE ) olcAttributeTypes: {39}( 1.3.6.1.4.1.3317.4.3.1.52 NAME 'radiusRealm' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {40}( 1.3.6.1.4.1.3317.4.3.1.32 NAME 'radiusServiceType' DE SC 'replyItem: Service-Type' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1 466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {41}( 1.3.6.1.4.1.3317.4.3.1.33 NAME 'radiusSessionTimeout' DESC 'replyItem: Session-Timeout' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1 .4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {42}( 1.3.6.1.4.1.3317.4.3.1.34 NAME 'radiusTerminationActi on' DESC 'replyItem: Termination-Action' EQUALITY caseIgnoreIA5Match SYNTAX 1 .3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {43}( 1.3.6.1.4.1.3317.4.3.1.35 NAME 'radiusTunnelAssignmen tId' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {44}( 1.3.6.1.4.1.3317.4.3.1.36 NAME 'radiusTunnelMediumTyp e' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {45}( 1.3.6.1.4.1.3317.4.3.1.37 NAME 'radiusTunnelPassword' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SIN GLE-VALUE ) olcAttributeTypes: {46}( 1.3.6.1.4.1.3317.4.3.1.38 NAME 'radiusTunnelPreferenc e' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {47}( 1.3.6.1.4.1.3317.4.3.1.39 NAME 'radiusTunnelPrivateGr oupId' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1. 26 ) olcAttributeTypes: {48}( 1.3.6.1.4.1.3317.4.3.1.40 NAME 'radiusTunnelServerEnd point' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1. 26 ) olcAttributeTypes: {49}( 1.3.6.1.4.1.3317.4.3.1.41 NAME 'radiusTunnelType' DES C '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {50}( 1.3.6.1.4.1.3317.4.3.1.42 NAME 'radiusVSA' DESC '' EQ UALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {51}( 1.3.6.1.4.1.3317.4.3.1.43 NAME 'radiusTunnelClientEnd point' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1. 26 ) olcAttributeTypes: {52}( 1.3.6.1.4.1.3317.4.3.1.53 NAME 'radiusSimultaneousUse ' DESC 'checkItem: Simultaneous-Use' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SIN GLE-VALUE ) olcAttributeTypes: {53}( 1.3.6.1.4.1.3317.4.3.1.54 NAME 'radiusLoginTime' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-V ALUE ) olcAttributeTypes: {54}( 1.3.6.1.4.1.3317.4.3.1.55 NAME 'radiusUserCategory' D ESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGL E-VALUE ) olcAttributeTypes: {55}( 1.3.6.1.4.1.3317.4.3.1.56 NAME 'radiusStripUserName' DESC '' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {56}( 1.3.6.1.4.1.3317.4.3.1.57 NAME 'dialupAccess' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALU E ) olcAttributeTypes: {57}( 1.3.6.1.4.1.3317.4.3.1.58 NAME 'radiusExpiration' DES C 'checkItem: Expiration' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466 .115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {58}( 1.3.6.1.4.1.3317.4.3.1.59 NAME 'radiusCheckItem' DESC 'checkItem: $GENERIC$' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.26 ) olcAttributeTypes: {59}( 1.3.6.1.4.1.3317.4.3.1.60 NAME 'radiusReplyItem' DESC 'replyItem: $GENERIC$' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.26 ) olcAttributeTypes: {60}( 1.3.6.1.4.1.3317.4.3.1.61 NAME 'radiusNASIpAddress' D ESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGL E-VALUE ) olcAttributeTypes: {61}( 1.3.6.1.4.1.3317.4.3.1.62 NAME 'radiusReplyMessage' D ESC 'replyItem: Reply-Message' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1 .1466.115.121.1.26 ) olcObjectClasses: {0}( 1.3.6.1.4.1.3317.4.3.2.1 NAME 'radiusprofile' DESC '' S UP top AUXILIARY MUST cn MAY ( radiusArapFeatures $ radiusArapSecurity $ radi usArapZoneAccess $ radiusAuthType $ radiusCallbackId $ radiusCallbackNumber $ radiusCalledStationId $ radiusCallingStationId $ radiusClass $ radiusClientI PAddress $ radiusFilterId $ radiusFramedAppleTalkLink $ radiusFramedAppleTalk Network $ radiusFramedAppleTalkZone $ radiusFramedCompression $ radiusFramedI PAddress $ radiusFramedIPNetmask $ radiusFramedIPXNetwork $ radiusFramedMTU $ radiusFramedProtocol $ radiusCheckItem $ radiusReplyItem $ radiusFramedRoute $ radiusFramedRouting $ radiusIdleTimeout $ radiusGroupName $ radiusHint $ r adiusHuntgroupName $ radiusLoginIPHost $ radiusLoginLATGroup $ radiusLoginLAT Node $ radiusLoginLATPort $ radiusLoginLATService $ radiusLoginService $ radi usLoginTCPPort $ radiusLoginTime $ radiusPasswordRetry $ radiusPortLimit $ ra diusPrompt $ radiusProxyToRealm $ radiusRealm $ radiusReplicateToRealm $ radi usServiceType $ radiusSessionTimeout $ radiusStripUserName $ radiusTerminatio nAction $ radiusTunnelClientEndpoint $ radiusProfileDn $ radiusSimultaneousUs e $ radiusTunnelAssignmentId $ radiusTunnelMediumType $ radiusTunnelPassword $ radiusTunnelPreference $ radiusTunnelPrivateGroupId $ radiusTunnelServerEnd point $ radiusTunnelType $ radiusUserCategory $ radiusVSA $ radiusExpiration $ dialupAccess $ radiusNASIpAddress $ radiusReplyMessage ) ) olcObjectClasses: {1}( 1.3.6.1.4.1.3317.4.3.2.2 NAME 'radiusObjectProfile' DES C 'A Container Objectclass to be used for creating radius profile object' SUP top STRUCTURAL MUST cn MAY ( uid $ userPassword $ description ) ) # {6}ppolicy, schema, config dn: cn={6}ppolicy,cn=schema,cn=config objectClass: olcSchemaConfig cn: {6}ppolicy olcAttributeTypes: {0}( 1.3.6.1.4.1.42.2.27.8.1.1 NAME 'pwdAttribute' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 ) olcAttributeTypes: {1}( 1.3.6.1.4.1.42.2.27.8.1.2 NAME 'pwdMinAge' EQUALITY in tegerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {2}( 1.3.6.1.4.1.42.2.27.8.1.3 NAME 'pwdMaxAge' EQUALITY in tegerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {3}( 1.3.6.1.4.1.42.2.27.8.1.4 NAME 'pwdInHistory' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1 .27 SINGLE-VALUE ) olcAttributeTypes: {4}( 1.3.6.1.4.1.42.2.27.8.1.5 NAME 'pwdCheckQuality' EQUAL ITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.27 SINGLE-VALUE ) olcAttributeTypes: {5}( 1.3.6.1.4.1.42.2.27.8.1.6 NAME 'pwdMinLength' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121. 1.27 SINGLE-VALUE ) olcAttributeTypes: {6}( 1.3.6.1.4.1.42.2.27.8.1.7 NAME 'pwdExpireWarning' EQUA LITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115. 121.1.27 SINGLE-VALUE ) olcAttributeTypes: {7}( 1.3.6.1.4.1.42.2.27.8.1.8 NAME 'pwdGraceAuthNLimit' EQ UALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.11 5.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {8}( 1.3.6.1.4.1.42.2.27.8.1.9 NAME 'pwdLockout' EQUALITY b ooleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {9}( 1.3.6.1.4.1.42.2.27.8.1.10 NAME 'pwdLockoutDuration' E QUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {10}( 1.3.6.1.4.1.42.2.27.8.1.11 NAME 'pwdMaxFailure' EQUAL ITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.1 21.1.27 SINGLE-VALUE ) olcAttributeTypes: {11}( 1.3.6.1.4.1.42.2.27.8.1.12 NAME 'pwdFailureCountInter val' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1. 1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {12}( 1.3.6.1.4.1.42.2.27.8.1.13 NAME 'pwdMustChange' EQUAL ITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {13}( 1.3.6.1.4.1.42.2.27.8.1.14 NAME 'pwdAllowUserChange' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {14}( 1.3.6.1.4.1.42.2.27.8.1.15 NAME 'pwdSafeModify' EQUAL ITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {15}( 1.3.6.1.4.1.4754.1.99.1 NAME 'pwdCheckModule' DESC 'L oadable module that instantiates "check_password() function' EQUALITY caseExa ctIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {16}( 1.3.6.1.4.1.42.2.27.8.1.30 NAME 'pwdMaxRecordedFailur e' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.14 66.115.121.1.27 SINGLE-VALUE ) olcObjectClasses: {0}( 1.3.6.1.4.1.4754.2.99.1 NAME 'pwdPolicyChecker' SUP top AUXILIARY MAY pwdCheckModule ) olcObjectClasses: {1}( 1.3.6.1.4.1.42.2.27.8.2.1 NAME 'pwdPolicy' SUP top AUXI LIARY MUST pwdAttribute MAY ( pwdMinAge $ pwdMaxAge $ pwdInHistory $ pwdCheck Quality $ pwdMinLength $ pwdExpireWarning $ pwdGraceAuthNLimit $ pwdLockout $ pwdLockoutDuration $ pwdMaxFailure $ pwdFailureCountInterval $ pwdMustChange $ pwdAllowUserChange $ pwdSafeModify $ pwdMaxRecordedFailure ) ) # {-1}frontend, config dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend # {0}config, config dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth" manage by * none olcRootDN: cn=admin,cn=config olcRootPW: redacted # {0}syncprov, {0}config, config dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 5 5 olcSpSessionlog: 1000 # {1}monitor, config dn: olcDatabase={1}monitor,cn=config objectClass: olcDatabaseConfig olcDatabase: {1}monitor olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth" read by dn.base="cn=Manager,dc=my-domain,dc=com" read by * none # {2}hdb, config dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=concentricsky,dc=com olcAccess: {0}to attrs=userPassword by self write by dn.exact="cn=manager,dc=c oncentricsky,dc=com" write by dn.exact="uid=ldappwsync,ou=accounts,dc=concent ricsky,dc=com,dc=concentricsky,dc=com" write by dn.exact="uid=teamalter,ou=ac counts,dc=concentricsky,dc=com" write by dn.exact="uid=useradd,ou=accounts,dc =concentricsky,dc=com" write by dn.exact="uid=replication,ou=accounts,dc=conc entricsky,dc=com,dc=concentricsky,dc=com" read by anonymous auth by * read olcAccess: {1}to attrs=sshPublicKey by self write by dn.exact="cn=manager,dc=c oncentricsky,dc=com" write by dn.exact="uid=keysync,ou=accounts,dc=concentric sky,dc=com" write by dn.exact="uid=teamalter,ou=accounts,dc=concentricsky,dc= com" write by dn.exact="uid=useradd,ou=accounts,dc=concentricsky,dc=com" writ e by dn.exact="uid=replication,ou=accounts,dc=concentricsky,dc=com,dc=concent ricsky,dc=com" read by * read olcAccess: {2}to * by self write by anonymous auth by dn.exact="cn=manager,dc= concentricsky,dc=com" write by dn.exact="uid=teamalter,ou=accounts,dc=concent ricsky,dc=com" write by dn.exact="uid=useradd,ou=accounts,dc=concentricsky,dc =com" write by dn.exact="uid=replication,ou=accounts,dc=concentricsky,dc=com, dc=concentricsky,dc=com" read by users read by * none olcAccess: {3}to dn.base="dc=concentricsky,dc=com" by self write by anonymous auth by dn.exact="cn=manager,dc=concentricsky,dc=com" write by dn.exact="uid= replication,ou=accounts,dc=concentricsky,dc=com,dc=concentricsky,dc=com" read by dn.exact="uid=teamalter,ou=accounts,dc=concentricsky,dc=com" write by dn. exact="uid=useradd,ou=accounts,dc=concentricsky,dc=com" write by group.exact= "cn=it,ou=groups,dc=concentricsky,dc=com" write by users read by * none olcRootDN: cn=manager,dc=concentricsky,dc=com olcRootPW: redacted olcDbIndex: objectClass eq,pres olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub # {0}syncprov, {2}hdb, config dn: olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 5 5 olcSpSessionlog: 1000 # {1}ppolicy, {2}hdb, config dn: olcOverlay={1}ppolicy,olcDatabase={2}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: {1}ppolicy olcPPolicyDefault: cn=default,ou=policies,dc=concentricsky,dc=com # search result search: 2 result: 0 Success # numResponses: 18 # numEntries: 17 On Mon, Jun 8, 2020 at 11:05 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Monday, June 8, 2020 11:59 AM -0700 John Alexander > <jalexander(a)concentricsky.com> wrote: > > > > > > > The pressing matter at this point is that I need to get my server (which > > is my master node) into a consistent state. As I see it, I have 2 > > options: > > > > > > - remove (by some means) the olcOverlay={1}ppolicy,oldDatabase={2}hdb > > entry since it seems to be the cause of the inability to slapcat the > > cn=config > > can this be accomplished manually? > > As I literaly just said: > > There's no evidence that what is being provided by slapcat is what slapd > is > actually using. > > Also, as I just literally stated, you *could* export the cn=config db via > ldapsearch rather than slapcat, and have an exact copy of what slapd is > currently using. > > The output of both the ldapmodify & ldapsearch commands both contradict > what your slapcat is reporting, so again your default slapcat path does > not > appear to match slapd's path to the config database. > > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > -- John Alexander Systems Administrator E: jalexander(a)concentricsky.com Concentric Sky, Inc https://www.concentricsky.com

2 1

Re: ppolicy: attempting to load ppolicy module
by John Alexander 08 Jun '20

08 Jun '20

The pressing matter at this point is that I need to get my server (which is my master node) into a consistent state. As I see it, I have 2 options: - remove (by some means) the olcOverlay={1}ppolicy,oldDatabase={2}hdb entry since it seems to be the cause of the inability to slapcat the cn=config can this be accomplished manually? - reimport the cn=config backup I took last week before starting to add the ppolicy bits My understanding is that at this point, restarting slapd would result in a non-start. On Mon, Jun 8, 2020 at 10:47 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Monday, June 8, 2020 11:38 AM -0700 John Alexander > <jalexander(a)concentricsky.com> wrote: > > As Howard noted, there's no indiciation currently that the results of > "slapcat" are of the actual config DB being used by slapd. > > A copy of an older, unused config also doesn't really help much. > > You *could* export the current cn=config being used by slapd via > ldapsearch > of course. > > Regards, > Quanah > > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > -- John Alexander Systems Administrator E: jalexander(a)concentricsky.com Concentric Sky, Inc https://www.concentricsky.com

2 1

Re: ppolicy: attempting to load ppolicy module
by John Alexander 08 Jun '20

08 Jun '20

currently, slapcat -n 0 yields the error: 5ede54b5 UNKNOWN attributeDescription "OLCPPOLICYDEFAULT" inserted. 5ede54b5 config error processing olcOverlay={1}ppolicy,olcDatabase={2}hdb,cn=config: slapcat: bad configuration file! And so I'm unable to perform a dump of cn=config. Fortunately I did dump cn=config before I started this work. Here is the output: (please note that this will not contain any of the ppolicy schema or attempt to load the ppolicy module or the ppolicy overlay.) ---------------- dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/openldap/slapd.args olcPidFile: /var/run/openldap/slapd.pid olcTLSCACertificatePath: /etc/openldap/certs structuralObjectClass: olcGlobal entryUUID: c2bee694-3ec1-1035-8801-6baaf2990e78 creatorsName: cn=config createTimestamp: 20151224193915Z olcTLSCertificateFile: /etc/openldap/certs/ldap.concentricsky.com.crt olcTLSCertificateKeyFile: /etc/openldap/certs/ldap.concentricsky.com.key olcTLSCACertificateFile: /etc/openldap/certs/ldap.concentricsky.com.chain.cr t olcLogLevel: stats acl sync entryCSN: 20151224194011.386071Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20151224194011Z contextCSN: 20151224194011.395722Z#000000#000#000000 dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib64/openldap olcModuleLoad: {0}back_bdb olcModuleLoad: {1}syncprov dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema structuralObjectClass: olcSchemaConfig entryUUID: c2beec84-3ec1-1035-8802-6baaf2990e78 creatorsName: cn=config createTimestamp: 20151224193915Z entryCSN: 20151224193915.756726Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20151224193915Z dn: cn={0}core,cn=schema,cn=config objectClass: olcSchemaConfig cn: {0}core olcAttributeTypes: {0}( 2.5.4.2 NAME 'knowledgeInformation' DESC 'RFC2256: k nowledge information' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115. 121.1.15{32768} ) olcAttributeTypes: {1}( 2.5.4.4 NAME ( 'sn' 'surname' ) DESC 'RFC2256: last (family) name(s) for which the entity is known by' SUP name ) olcAttributeTypes: {2}( 2.5.4.5 NAME 'serialNumber' DESC 'RFC2256: serial nu mber of the entity' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44{64} ) olcAttributeTypes: {3}( 2.5.4.6 NAME ( 'c' 'countryName' ) DESC 'RFC4519: tw o-letter ISO-3166 country code' SUP name SYNTAX 1.3.6.1.4.1.1466.115.121.1. 11 SINGLE-VALUE ) olcAttributeTypes: {4}( 2.5.4.7 NAME ( 'l' 'localityName' ) DESC 'RFC2256: l ocality which this object resides in' SUP name ) olcAttributeTypes: {5}( 2.5.4.8 NAME ( 'st' 'stateOrProvinceName' ) DESC 'RF C2256: state or province which this object resides in' SUP name ) olcAttributeTypes: {6}( 2.5.4.9 NAME ( 'street' 'streetAddress' ) DESC 'RFC2 256: street address of this object' EQUALITY caseIgnoreMatch SUBSTR caseIgn oreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) olcAttributeTypes: {7}( 2.5.4.10 NAME ( 'o' 'organizationName' ) DESC 'RFC22 56: organization this object belongs to' SUP name ) olcAttributeTypes: {8}( 2.5.4.11 NAME ( 'ou' 'organizationalUnitName' ) DESC 'RFC2256: organizational unit this object belongs to' SUP name ) olcAttributeTypes: {9}( 2.5.4.12 NAME 'title' DESC 'RFC2256: title associate d with the entity' SUP name ) olcAttributeTypes: {10}( 2.5.4.14 NAME 'searchGuide' DESC 'RFC2256: search g uide, deprecated by enhancedSearchGuide' SYNTAX 1.3.6.1.4.1.1466.115.121.1. 25 ) olcAttributeTypes: {11}( 2.5.4.15 NAME 'businessCategory' DESC 'RFC2256: bus iness category' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch S YNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) olcAttributeTypes: {12}( 2.5.4.16 NAME 'postalAddress' DESC 'RFC2256: postal address' EQUALITY caseIgnoreListMatch SUBSTR caseIgnoreListSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 ) olcAttributeTypes: {13}( 2.5.4.17 NAME 'postalCode' DESC 'RFC2256: postal co de' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6. 1.4.1.1466.115.121.1.15{40} ) olcAttributeTypes: {14}( 2.5.4.18 NAME 'postOfficeBox' DESC 'RFC2256: Post O ffice Box' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{40} ) olcAttributeTypes: {15}( 2.5.4.19 NAME 'physicalDeliveryOfficeName' DESC 'RF C2256: Physical Delivery Office Name' EQUALITY caseIgnoreMatch SUBSTR caseI gnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) olcAttributeTypes: {16}( 2.5.4.20 NAME 'telephoneNumber' DESC 'RFC2256: Tele phone Number' EQUALITY telephoneNumberMatch SUBSTR telephoneNumberSubstring sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.50{32} ) olcAttributeTypes: {17}( 2.5.4.21 NAME 'telexNumber' DESC 'RFC2256: Telex Nu mber' SYNTAX 1.3.6.1.4.1.1466.115.121.1.52 ) olcAttributeTypes: {18}( 2.5.4.22 NAME 'teletexTerminalIdentifier' DESC 'RFC 2256: Teletex Terminal Identifier' SYNTAX 1.3.6.1.4.1.1466.115.121.1.51 ) olcAttributeTypes: {19}( 2.5.4.23 NAME ( 'facsimileTelephoneNumber' 'fax' ) DESC 'RFC2256: Facsimile (Fax) Telephone Number' SYNTAX 1.3.6.1.4.1.1466.11 5.121.1.22 ) olcAttributeTypes: {20}( 2.5.4.24 NAME 'x121Address' DESC 'RFC2256: X.121 Ad dress' EQUALITY numericStringMatch SUBSTR numericStringSubstringsMatch SYNT AX 1.3.6.1.4.1.1466.115.121.1.36{15} ) olcAttributeTypes: {21}( 2.5.4.25 NAME 'internationaliSDNNumber' DESC 'RFC22 56: international ISDN number' EQUALITY numericStringMatch SUBSTR numericSt ringSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.36{16} ) olcAttributeTypes: {22}( 2.5.4.26 NAME 'registeredAddress' DESC 'RFC2256: re gistered postal address' SUP postalAddress SYNTAX 1.3.6.1.4.1.1466.115.121. 1.41 ) olcAttributeTypes: {23}( 2.5.4.27 NAME 'destinationIndicator' DESC 'RFC2256: destination indicator' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstring sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44{128} ) olcAttributeTypes: {24}( 2.5.4.28 NAME 'preferredDeliveryMethod' DESC 'RFC22 56: preferred delivery method' SYNTAX 1.3.6.1.4.1.1466.115.121.1.14 SINGLE- VALUE ) olcAttributeTypes: {25}( 2.5.4.29 NAME 'presentationAddress' DESC 'RFC2256: presentation address' EQUALITY presentationAddressMatch SYNTAX 1.3.6.1.4.1. 1466.115.121.1.43 SINGLE-VALUE ) olcAttributeTypes: {26}( 2.5.4.30 NAME 'supportedApplicationContext' DESC 'R FC2256: supported application context' EQUALITY objectIdentifierMatch SYNTA X 1.3.6.1.4.1.1466.115.121.1.38 ) olcAttributeTypes: {27}( 2.5.4.31 NAME 'member' DESC 'RFC2256: member of a g roup' SUP distinguishedName ) olcAttributeTypes: {28}( 2.5.4.32 NAME 'owner' DESC 'RFC2256: owner (of the object)' SUP distinguishedName ) olcAttributeTypes: {29}( 2.5.4.33 NAME 'roleOccupant' DESC 'RFC2256: occupan t of role' SUP distinguishedName ) olcAttributeTypes: {30}( 2.5.4.36 NAME 'userCertificate' DESC 'RFC2256: X.50 9 user certificate, use ;binary' EQUALITY certificateExactMatch SYNTAX 1.3. 6.1.4.1.1466.115.121.1.8 ) olcAttributeTypes: {31}( 2.5.4.37 NAME 'cACertificate' DESC 'RFC2256: X.509 CA certificate, use ;binary' EQUALITY certificateExactMatch SYNTAX 1.3.6.1. 4.1.1466.115.121.1.8 ) olcAttributeTypes: {32}( 2.5.4.38 NAME 'authorityRevocationList' DESC 'RFC22 56: X.509 authority revocation list, use ;binary' SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.9 ) olcAttributeTypes: {33}( 2.5.4.39 NAME 'certificateRevocationList' DESC 'RFC 2256: X.509 certificate revocation list, use ;binary' SYNTAX 1.3.6.1.4.1.14 66.115.121.1.9 ) olcAttributeTypes: {34}( 2.5.4.40 NAME 'crossCertificatePair' DESC 'RFC2256: X.509 cross certificate pair, use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.121 .1.10 ) olcAttributeTypes: {35}( 2.5.4.42 NAME ( 'givenName' 'gn' ) DESC 'RFC2256: f irst name(s) for which the entity is known by' SUP name ) olcAttributeTypes: {36}( 2.5.4.43 NAME 'initials' DESC 'RFC2256: initials of some or all of names, but not the surname(s).' SUP name ) olcAttributeTypes: {37}( 2.5.4.44 NAME 'generationQualifier' DESC 'RFC2256: name qualifier indicating a generation' SUP name ) olcAttributeTypes: {38}( 2.5.4.45 NAME 'x500UniqueIdentifier' DESC 'RFC2256: X.500 unique identifier' EQUALITY bitStringMatch SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.6 ) olcAttributeTypes: {39}( 2.5.4.46 NAME 'dnQualifier' DESC 'RFC2256: DN quali fier' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR case IgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44 ) olcAttributeTypes: {40}( 2.5.4.47 NAME 'enhancedSearchGuide' DESC 'RFC2256: enhanced search guide' SYNTAX 1.3.6.1.4.1.1466.115.121.1.21 ) olcAttributeTypes: {41}( 2.5.4.48 NAME 'protocolInformation' DESC 'RFC2256: protocol information' EQUALITY protocolInformationMatch SYNTAX 1.3.6.1.4.1. 1466.115.121.1.42 ) olcAttributeTypes: {42}( 2.5.4.50 NAME 'uniqueMember' DESC 'RFC2256: unique member of a group' EQUALITY uniqueMemberMatch SYNTAX 1.3.6.1.4.1.1466.115.1 21.1.34 ) olcAttributeTypes: {43}( 2.5.4.51 NAME 'houseIdentifier' DESC 'RFC2256: hous e identifier' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYN TAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) olcAttributeTypes: {44}( 2.5.4.52 NAME 'supportedAlgorithms' DESC 'RFC2256: supported algorithms' SYNTAX 1.3.6.1.4.1.1466.115.121.1.49 ) olcAttributeTypes: {45}( 2.5.4.53 NAME 'deltaRevocationList' DESC 'RFC2256: delta revocation list; use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.121.1.9 ) olcAttributeTypes: {46}( 2.5.4.54 NAME 'dmdName' DESC 'RFC2256: name of DMD' SUP name ) olcAttributeTypes: {47}( 2.5.4.65 NAME 'pseudonym' DESC 'X.520(4th): pseudon ym for the object' SUP name ) olcAttributeTypes: {48}( 0.9.2342.19200300.100.1.3 NAME ( 'mail' 'rfc822Mail box' ) DESC 'RFC1274: RFC822 Mailbox' EQUALITY caseIgnoreIA5Match SUBST R caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) olcAttributeTypes: {49}( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domainCompo nent' ) DESC 'RFC1274/2247: domain component' EQUALITY caseIgnoreIA5Match S UBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SIN GLE-VALUE ) olcAttributeTypes: {50}( 0.9.2342.19200300.100.1.37 NAME 'associatedDomain' DESC 'RFC1274: domain associated with object' EQUALITY caseIgnoreIA5Match S UBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {51}( 1.2.840.113549.1.9.1 NAME ( 'email' 'emailAddress' 'pkcs9email' ) DESC 'RFC3280: legacy attribute for email addresses in DNs' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3. 6.1.4.1.1466.115.121.1.26{128} ) olcObjectClasses: {0}( 2.5.6.2 NAME 'country' DESC 'RFC2256: a country' SUP top STRUCTURAL MUST c MAY ( searchGuide $ description ) ) olcObjectClasses: {1}( 2.5.6.3 NAME 'locality' DESC 'RFC2256: a locality' SU P top STRUCTURAL MAY ( street $ seeAlso $ searchGuide $ st $ l $ descriptio n ) ) olcObjectClasses: {2}( 2.5.6.4 NAME 'organization' DESC 'RFC2256: an organiz ation' SUP top STRUCTURAL MUST o MAY ( userPassword $ searchGuide $ seeAlso $ businessCategory $ x121Address $ registeredAddress $ destinationIndicato r $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ tel ephoneNumber $ internationaliSDNNumber $ facsimileTelephoneNumber $ street $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ st $ l $ description ) ) olcObjectClasses: {3}( 2.5.6.5 NAME 'organizationalUnit' DESC 'RFC2256: an o rganizational unit' SUP top STRUCTURAL MUST ou MAY ( userPassword $ searchG uide $ seeAlso $ businessCategory $ x121Address $ registeredAddress $ desti nationIndicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalId entifier $ telephoneNumber $ internationaliSDNNumber $ facsimileTelephoneNu mber $ street $ postOfficeBox $ postalCode $ postalAddress $ physicalDelive ryOfficeName $ st $ l $ description ) ) olcObjectClasses: {4}( 2.5.6.6 NAME 'person' DESC 'RFC2256: a person' SUP to p STRUCTURAL MUST ( sn $ cn ) MAY ( userPassword $ telephoneNumber $ seeAls o $ description ) ) olcObjectClasses: {5}( 2.5.6.7 NAME 'organizationalPerson' DESC 'RFC2256: an organizational person' SUP person STRUCTURAL MAY ( title $ x121Address $ r egisteredAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNu mber $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumbe r $ facsimileTelephoneNumber $ street $ postOfficeBox $ postalCode $ posta lAddress $ physicalDeliveryOfficeName $ ou $ st $ l ) ) olcObjectClasses: {6}( 2.5.6.8 NAME 'organizationalRole' DESC 'RFC2256: an o rganizational role' SUP top STRUCTURAL MUST cn MAY ( x121Address $ register edAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $ fac simileTelephoneNumber $ seeAlso $ roleOccupant $ preferredDeliveryMethod $ street $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOffic eName $ ou $ st $ l $ description ) ) olcObjectClasses: {7}( 2.5.6.9 NAME 'groupOfNames' DESC 'RFC2256: a group of names (DNs)' SUP top STRUCTURAL MUST ( member $ cn ) MAY ( businessCategor y $ seeAlso $ owner $ ou $ o $ description ) ) olcObjectClasses: {8}( 2.5.6.10 NAME 'residentialPerson' DESC 'RFC2256: an r esidential person' SUP person STRUCTURAL MUST l MAY ( businessCategory $ x1 21Address $ registeredAddress $ destinationIndicator $ preferredDeliveryMet hod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internati onaliSDNNumber $ facsimileTelephoneNumber $ preferredDeliveryMethod $ stree t $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ st $ l ) ) olcObjectClasses: {9}( 2.5.6.11 NAME 'applicationProcess' DESC 'RFC2256: an application process' SUP top STRUCTURAL MUST cn MAY ( seeAlso $ ou $ l $ de scription ) ) olcObjectClasses: {10}( 2.5.6.12 NAME 'applicationEntity' DESC 'RFC2256: an application entity' SUP top STRUCTURAL MUST ( presentationAddress $ cn ) MA Y ( supportedApplicationContext $ seeAlso $ ou $ o $ l $ description ) ) olcObjectClasses: {11}( 2.5.6.13 NAME 'dSA' DESC 'RFC2256: a directory syste m agent (a server)' SUP applicationEntity STRUCTURAL MAY knowledgeInformati on ) olcObjectClasses: {12}( 2.5.6.14 NAME 'device' DESC 'RFC2256: a device' SUP top STRUCTURAL MUST cn MAY ( serialNumber $ seeAlso $ owner $ ou $ o $ l $ description ) ) olcObjectClasses: {13}( 2.5.6.15 NAME 'strongAuthenticationUser' DESC 'RFC22 56: a strong authentication user' SUP top AUXILIARY MUST userCertificate ) olcObjectClasses: {14}( 2.5.6.16 NAME 'certificationAuthority' DESC 'RFC2256 : a certificate authority' SUP top AUXILIARY MUST ( authorityRevocationList $ certificateRevocationList $ cACertificate ) MAY crossCertificatePair ) olcObjectClasses: {15}( 2.5.6.17 NAME 'groupOfUniqueNames' DESC 'RFC2256: a group of unique names (DN and Unique Identifier)' SUP top STRUCTURAL MUST ( uniqueMember $ cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ de scription ) ) olcObjectClasses: {16}( 2.5.6.18 NAME 'userSecurityInformation' DESC 'RFC225 6: a user security information' SUP top AUXILIARY MAY ( supportedAlgorithms ) ) olcObjectClasses: {17}( 2.5.6.16.2 NAME 'certificationAuthority-V2' SUP cert ificationAuthority AUXILIARY MAY ( deltaRevocationList ) ) olcObjectClasses: {18}( 2.5.6.19 NAME 'cRLDistributionPoint' SUP top STRUCTU RAL MUST ( cn ) MAY ( certificateRevocationList $ authorityRevocationList $ deltaRevocationList ) ) olcObjectClasses: {19}( 2.5.6.20 NAME 'dmd' SUP top STRUCTURAL MUST ( dmdNam e ) MAY ( userPassword $ searchGuide $ seeAlso $ businessCategory $ x121Add ress $ registeredAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internationali SDNNumber $ facsimileTelephoneNumber $ street $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ st $ l $ description ) ) olcObjectClasses: {20}( 2.5.6.21 NAME 'pkiUser' DESC 'RFC2587: a PKI user' S UP top AUXILIARY MAY userCertificate ) olcObjectClasses: {21}( 2.5.6.22 NAME 'pkiCA' DESC 'RFC2587: PKI certificate authority' SUP top AUXILIARY MAY ( authorityRevocationList $ certificateRe vocationList $ cACertificate $ crossCertificatePair ) ) olcObjectClasses: {22}( 2.5.6.23 NAME 'deltaCRL' DESC 'RFC2587: PKI user' SU P top AUXILIARY MAY deltaRevocationList ) olcObjectClasses: {23}( 1.3.6.1.4.1.250.3.15 NAME 'labeledURIObject' DESC 'R FC2079: object that contains the URI attribute type' MAY ( labeledURI ) SUP top AUXILIARY ) olcObjectClasses: {24}( 0.9.2342.19200300.100.4.19 NAME 'simpleSecurityObjec t' DESC 'RFC1274: simple security object' SUP top AUXILIARY MUST userPasswo rd ) olcObjectClasses: {25}( 1.3.6.1.4.1.1466.344 NAME 'dcObject' DESC 'RFC2247: domain component object' SUP top AUXILIARY MUST dc ) olcObjectClasses: {26}( 1.3.6.1.1.3.1 NAME 'uidObject' DESC 'RFC2377: uid ob ject' SUP top AUXILIARY MUST uid ) structuralObjectClass: olcSchemaConfig entryUUID: c2befad0-3ec1-1035-8803-6baaf2990e78 creatorsName: cn=config createTimestamp: 20151224193915Z entryCSN: 20151224193915.757091Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20151224193915Z dn: cn={1}cosine,cn=schema,cn=config objectClass: olcSchemaConfig cn: {1}cosine olcAttributeTypes: {0}( 0.9.2342.19200300.100.1.2 NAME 'textEncodedORAddress ' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1. 4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {1}( 0.9.2342.19200300.100.1.4 NAME 'info' DESC 'RFC1274: general information' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsM atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{2048} ) olcAttributeTypes: {2}( 0.9.2342.19200300.100.1.5 NAME ( 'drink' 'favouriteD rink' ) DESC 'RFC1274: favorite drink' EQUALITY caseIgnoreMatch SUBSTR case IgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {3}( 0.9.2342.19200300.100.1.6 NAME 'roomNumber' DESC 'RF C1274: room number' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {4}( 0.9.2342.19200300.100.1.7 NAME 'photo' DESC 'RFC1274 : photo (G3 fax)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.23{25000} ) olcAttributeTypes: {5}( 0.9.2342.19200300.100.1.8 NAME 'userClass' DESC 'RFC 1274: category of user' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstring sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {6}( 0.9.2342.19200300.100.1.9 NAME 'host' DESC 'RFC1274: host computer' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch S YNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {7}( 0.9.2342.19200300.100.1.10 NAME 'manager' DESC 'RFC1 274: DN of manager' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466 .115.121.1.12 ) olcAttributeTypes: {8}( 0.9.2342.19200300.100.1.11 NAME 'documentIdentifier' DESC 'RFC1274: unique identifier of document' EQUALITY caseIgnoreMatch SUB STR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {9}( 0.9.2342.19200300.100.1.12 NAME 'documentTitle' DESC 'RFC1274: title of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSub stringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {10}( 0.9.2342.19200300.100.1.13 NAME 'documentVersion' D ESC 'RFC1274: version of document' EQUALITY caseIgnoreMatch SUBSTR caseIgno reSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {11}( 0.9.2342.19200300.100.1.14 NAME 'documentAuthor' DE SC 'RFC1274: DN of author of document' EQUALITY distinguishedNameMatch SYNT AX 1.3.6.1.4.1.1466.115.121.1.12 ) olcAttributeTypes: {12}( 0.9.2342.19200300.100.1.15 NAME 'documentLocation' DESC 'RFC1274: location of document original' EQUALITY caseIgnoreMatch SUBS TR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {13}( 0.9.2342.19200300.100.1.20 NAME ( 'homePhone' 'home TelephoneNumber' ) DESC 'RFC1274: home telephone number' EQUALITY telephone NumberMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.50 ) olcAttributeTypes: {14}( 0.9.2342.19200300.100.1.21 NAME 'secretary' DESC 'R FC1274: DN of secretary' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1 .1466.115.121.1.12 ) olcAttributeTypes: {15}( 0.9.2342.19200300.100.1.22 NAME 'otherMailbox' SYNT AX 1.3.6.1.4.1.1466.115.121.1.39 ) olcAttributeTypes: {16}( 0.9.2342.19200300.100.1.26 NAME 'aRecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {17}( 0.9.2342.19200300.100.1.27 NAME 'mDRecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {18}( 0.9.2342.19200300.100.1.28 NAME 'mXRecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {19}( 0.9.2342.19200300.100.1.29 NAME 'nSRecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {20}( 0.9.2342.19200300.100.1.30 NAME 'sOARecord' EQUALIT Y caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {21}( 0.9.2342.19200300.100.1.31 NAME 'cNAMERecord' EQUAL ITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {22}( 0.9.2342.19200300.100.1.38 NAME 'associatedName' DE SC 'RFC1274: DN of entry associated with domain' EQUALITY distinguishedName Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 ) olcAttributeTypes: {23}( 0.9.2342.19200300.100.1.39 NAME 'homePostalAddress' DESC 'RFC1274: home postal address' EQUALITY caseIgnoreListMatch SUBSTR ca seIgnoreListSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 ) olcAttributeTypes: {24}( 0.9.2342.19200300.100.1.40 NAME 'personalTitle' DES C 'RFC1274: personal title' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubst ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {25}( 0.9.2342.19200300.100.1.41 NAME ( 'mobile' 'mobileT elephoneNumber' ) DESC 'RFC1274: mobile telephone number' EQUALITY telephon eNumberMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466. 115.121.1.50 ) olcAttributeTypes: {26}( 0.9.2342.19200300.100.1.42 NAME ( 'pager' 'pagerTel ephoneNumber' ) DESC 'RFC1274: pager telephone number' EQUALITY telephoneNu mberMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115 .121.1.50 ) olcAttributeTypes: {27}( 0.9.2342.19200300.100.1.43 NAME ( 'co' 'friendlyCou ntryName' ) DESC 'RFC1274: friendly country name' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {28}( 0.9.2342.19200300.100.1.44 NAME 'uniqueIdentifier' DESC 'RFC1274: unique identifer' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4. 1.1466.115.121.1.15{256} ) olcAttributeTypes: {29}( 0.9.2342.19200300.100.1.45 NAME 'organizationalStat us' DESC 'RFC1274: organizational status' EQUALITY caseIgnoreMatch SUBSTR c aseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {30}( 0.9.2342.19200300.100.1.46 NAME 'janetMailbox' DESC 'RFC1274: Janet mailbox' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5S ubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) olcAttributeTypes: {31}( 0.9.2342.19200300.100.1.47 NAME 'mailPreferenceOpti on' DESC 'RFC1274: mail preference option' SYNTAX 1.3.6.1.4.1.1466.115.121. 1.27 ) olcAttributeTypes: {32}( 0.9.2342.19200300.100.1.48 NAME 'buildingName' DESC 'RFC1274: name of building' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubs tringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {33}( 0.9.2342.19200300.100.1.49 NAME 'dSAQuality' DESC ' RFC1274: DSA Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.19 SINGLE-VALUE ) olcAttributeTypes: {34}( 0.9.2342.19200300.100.1.50 NAME 'singleLevelQuality ' DESC 'RFC1274: Single Level Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.13 SINGLE-VALUE ) olcAttributeTypes: {35}( 0.9.2342.19200300.100.1.51 NAME 'subtreeMinimumQual ity' DESC 'RFC1274: Subtree Mininum Quality' SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.13 SINGLE-VALUE ) olcAttributeTypes: {36}( 0.9.2342.19200300.100.1.52 NAME 'subtreeMaximumQual ity' DESC 'RFC1274: Subtree Maximun Quality' SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.13 SINGLE-VALUE ) olcAttributeTypes: {37}( 0.9.2342.19200300.100.1.53 NAME 'personalSignature' DESC 'RFC1274: Personal Signature (G3 fax)' SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.23 ) olcAttributeTypes: {38}( 0.9.2342.19200300.100.1.54 NAME 'dITRedirect' DESC 'RFC1274: DIT Redirect' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1. 1466.115.121.1.12 ) olcAttributeTypes: {39}( 0.9.2342.19200300.100.1.55 NAME 'audio' DESC 'RFC12 74: audio (u-law)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.4{25000} ) olcAttributeTypes: {40}( 0.9.2342.19200300.100.1.56 NAME 'documentPublisher' DESC 'RFC1274: publisher of document' EQUALITY caseIgnoreMatch SUBSTR case IgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcObjectClasses: {0}( 0.9.2342.19200300.100.4.4 NAME ( 'pilotPerson' 'newPi lotPerson' ) SUP person STRUCTURAL MAY ( userid $ textEncodedORAddress $ rf c822Mailbox $ favouriteDrink $ roomNumber $ userClass $ homeTelephoneNumber $ homePostalAddress $ secretary $ personalTitle $ preferredDeliveryMethod $ businessCategory $ janetMailbox $ otherMailbox $ mobileTelephoneNumber $ pagerTelephoneNumber $ organizationalStatus $ mailPreferenceOption $ person alSignature ) ) olcObjectClasses: {1}( 0.9.2342.19200300.100.4.5 NAME 'account' SUP top STRU CTURAL MUST userid MAY ( description $ seeAlso $ localityName $ organizatio nName $ organizationalUnitName $ host ) ) olcObjectClasses: {2}( 0.9.2342.19200300.100.4.6 NAME 'document' SUP top STR UCTURAL MUST documentIdentifier MAY ( commonName $ description $ seeAlso $ localityName $ organizationName $ organizationalUnitName $ documentTitle $ documentVersion $ documentAuthor $ documentLocation $ documentPublisher ) ) olcObjectClasses: {3}( 0.9.2342.19200300.100.4.7 NAME 'room' SUP top STRUCTU RAL MUST commonName MAY ( roomNumber $ description $ seeAlso $ telephoneNum ber ) ) olcObjectClasses: {4}( 0.9.2342.19200300.100.4.9 NAME 'documentSeries' SUP t op STRUCTURAL MUST commonName MAY ( description $ seeAlso $ telephonenumber $ localityName $ organizationName $ organizationalUnitName ) ) olcObjectClasses: {5}( 0.9.2342.19200300.100.4.13 NAME 'domain' SUP top STRU CTURAL MUST domainComponent MAY ( associatedName $ organizationName $ descr iption $ businessCategory $ seeAlso $ searchGuide $ userPassword $ locality Name $ stateOrProvinceName $ streetAddress $ physicalDeliveryOfficeName $ p ostalAddress $ postalCode $ postOfficeBox $ streetAddress $ facsimileTeleph oneNumber $ internationalISDNNumber $ telephoneNumber $ teletexTerminalIden tifier $ telexNumber $ preferredDeliveryMethod $ destinationIndicator $ reg isteredAddress $ x121Address ) ) olcObjectClasses: {6}( 0.9.2342.19200300.100.4.14 NAME 'RFC822localPart' SUP domain STRUCTURAL MAY ( commonName $ surname $ description $ seeAlso $ tel ephoneNumber $ physicalDeliveryOfficeName $ postalAddress $ postalCode $ po stOfficeBox $ streetAddress $ facsimileTelephoneNumber $ internationalISDNN umber $ telephoneNumber $ teletexTerminalIdentifier $ telexNumber $ preferr edDeliveryMethod $ destinationIndicator $ registeredAddress $ x121Address ) ) olcObjectClasses: {7}( 0.9.2342.19200300.100.4.15 NAME 'dNSDomain' SUP domai n STRUCTURAL MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ C NAMERecord ) ) olcObjectClasses: {8}( 0.9.2342.19200300.100.4.17 NAME 'domainRelatedObject' DESC 'RFC1274: an object related to an domain' SUP top AUXILIARY MUST asso ciatedDomain ) olcObjectClasses: {9}( 0.9.2342.19200300.100.4.18 NAME 'friendlyCountry' SUP country STRUCTURAL MUST friendlyCountryName ) olcObjectClasses: {10}( 0.9.2342.19200300.100.4.20 NAME 'pilotOrganization' SUP ( organization $ organizationalUnit ) STRUCTURAL MAY buildingName ) olcObjectClasses: {11}( 0.9.2342.19200300.100.4.21 NAME 'pilotDSA' SUP dsa S TRUCTURAL MAY dSAQuality ) olcObjectClasses: {12}( 0.9.2342.19200300.100.4.22 NAME 'qualityLabelledData ' SUP top AUXILIARY MUST dsaQuality MAY ( subtreeMinimumQuality $ subtreeMa ximumQuality ) ) structuralObjectClass: olcSchemaConfig entryUUID: e21e21ee-3ec1-1035-9377-7b2d46829542 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20151224194008Z entryCSN: 20151224194008.390047Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20151224194008Z dn: cn={2}inetorgperson,cn=schema,cn=config objectClass: olcSchemaConfig cn: {2}inetorgperson olcAttributeTypes: {0}( 2.16.840.1.113730.3.1.1 NAME 'carLicense' DESC 'RFC2 798: vehicle license or registration plate' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {1}( 2.16.840.1.113730.3.1.2 NAME 'departmentNumber' DESC 'RFC2798: identifies a department within an organization' EQUALITY caseIgn oreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1 .15 ) olcAttributeTypes: {2}( 2.16.840.1.113730.3.1.241 NAME 'displayName' DESC 'R FC2798: preferred name to be used when displaying entries' EQUALITY caseIgn oreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1 .15 SINGLE-VALUE ) olcAttributeTypes: {3}( 2.16.840.1.113730.3.1.3 NAME 'employeeNumber' DESC ' RFC2798: numerically identifies an employee within an organization' EQUALIT Y caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466. 115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {4}( 2.16.840.1.113730.3.1.4 NAME 'employeeType' DESC 'RF C2798: type of employment for a person' EQUALITY caseIgnoreMatch SUBSTR cas eIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {5}( 0.9.2342.19200300.100.1.60 NAME 'jpegPhoto' DESC 'RF C2798: a JPEG image' SYNTAX 1.3.6.1.4.1.1466.115.121.1.28 ) olcAttributeTypes: {6}( 2.16.840.1.113730.3.1.39 NAME 'preferredLanguage' DE SC 'RFC2798: preferred written or spoken language for a person' EQUALITY ca seIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115. 121.1.15 SINGLE-VALUE ) olcAttributeTypes: {7}( 2.16.840.1.113730.3.1.40 NAME 'userSMIMECertificate' DESC 'RFC2798: PKCS#7 SignedData used to support S/MIME' SYNTAX 1.3.6.1.4. 1.1466.115.121.1.5 ) olcAttributeTypes: {8}( 2.16.840.1.113730.3.1.216 NAME 'userPKCS12' DESC 'RF C2798: personal identity information, a PKCS #12 PFX' SYNTAX 1.3.6.1.4.1.14 66.115.121.1.5 ) olcObjectClasses: {0}( 2.16.840.1.113730.3.2.2 NAME 'inetOrgPerson' DESC 'RF C2798: Internet Organizational Person' SUP organizationalPerson STRUCTURAL MAY( audio $ businessCategory $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ givenName $ homePhone $ homePostalAddres s $ initials $ jpegPhoto $ labeledURI $ mail $ manager $ mobile $ o $ pager $ photo$ roomNumber $ secretary $ uid $ userCertificate $ x500uniqueIdenti fier $ preferredLanguage $ userSMIMECertificate $ userPKCS12 ) ) structuralObjectClass: olcSchemaConfig entryUUID: e21ea13c-3ec1-1035-9378-7b2d46829542 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20151224194008Z entryCSN: 20151224194008.393309Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20151224194008Z dn: cn={3}nis,cn=schema,cn=config objectClass: olcSchemaConfig cn: {3}nis olcAttributeTypes: {0}( 1.3.6.1.1.1.1.2 NAME 'gecos' DESC 'The GECOS field; the common name' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substrings Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {1}( 1.3.6.1.1.1.1.3 NAME 'homeDirectory' DESC 'The absol ute path to the home directory' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4 .1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {2}( 1.3.6.1.1.1.1.4 NAME 'loginShell' DESC 'The path to the login shell' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121 .1.26 SINGLE-VALUE ) olcAttributeTypes: {3}( 1.3.6.1.1.1.1.5 NAME 'shadowLastChange' EQUALITY int egerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {4}( 1.3.6.1.1.1.1.6 NAME 'shadowMin' EQUALITY integerMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {5}( 1.3.6.1.1.1.1.7 NAME 'shadowMax' EQUALITY integerMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {6}( 1.3.6.1.1.1.1.8 NAME 'shadowWarning' EQUALITY intege rMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {7}( 1.3.6.1.1.1.1.9 NAME 'shadowInactive' EQUALITY integ erMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {8}( 1.3.6.1.1.1.1.10 NAME 'shadowExpire' EQUALITY intege rMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {9}( 1.3.6.1.1.1.1.11 NAME 'shadowFlag' EQUALITY integerM atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {10}( 1.3.6.1.1.1.1.12 NAME 'memberUid' EQUALITY caseExac tIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.26 ) olcAttributeTypes: {11}( 1.3.6.1.1.1.1.13 NAME 'memberNisNetgroup' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.146 6.115.121.1.26 ) olcAttributeTypes: {12}( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple' DESC 'Net group triple' SYNTAX 1.3.6.1.1.1.0.0 ) olcAttributeTypes: {13}( 1.3.6.1.1.1.1.15 NAME 'ipServicePort' EQUALITY inte gerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {14}( 1.3.6.1.1.1.1.16 NAME 'ipServiceProtocol' SUP name ) olcAttributeTypes: {15}( 1.3.6.1.1.1.1.17 NAME 'ipProtocolNumber' EQUALITY i ntegerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {16}( 1.3.6.1.1.1.1.18 NAME 'oncRpcNumber' EQUALITY integ erMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {17}( 1.3.6.1.1.1.1.19 NAME 'ipHostNumber' DESC 'IP addre ss' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} ) olcAttributeTypes: {18}( 1.3.6.1.1.1.1.20 NAME 'ipNetworkNumber' DESC 'IP ne twork' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128 } SINGLE-VALUE ) olcAttributeTypes: {19}( 1.3.6.1.1.1.1.21 NAME 'ipNetmaskNumber' DESC 'IP ne tmask' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128 } SINGLE-VALUE ) olcAttributeTypes: {20}( 1.3.6.1.1.1.1.22 NAME 'macAddress' DESC 'MAC addres s' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} ) olcAttributeTypes: {21}( 1.3.6.1.1.1.1.23 NAME 'bootParameter' DESC 'rpc.boo tparamd parameter' SYNTAX 1.3.6.1.1.1.0.1 ) olcAttributeTypes: {22}( 1.3.6.1.1.1.1.24 NAME 'bootFile' DESC 'Boot image n ame' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {23}( 1.3.6.1.1.1.1.26 NAME 'nisMapName' SUP name ) olcAttributeTypes: {24}( 1.3.6.1.1.1.1.27 NAME 'nisMapEntry' EQUALITY caseEx actIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115. 121.1.26{1024} SINGLE-VALUE ) olcObjectClasses: {0}( 1.3.6.1.1.1.2.0 NAME 'posixAccount' DESC 'Abstraction of an account with POSIX attributes' SUP top AUXILIARY MUST ( cn $ uid $ u idNumber $ gidNumber $ homeDirectory ) MAY ( userPassword $ loginShell $ ge cos $ description ) ) olcObjectClasses: {1}( 1.3.6.1.1.1.2.1 NAME 'shadowAccount' DESC 'Additional attributes for shadow passwords' SUP top AUXILIARY MUST uid MAY ( userPass word $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowIna ctive $ shadowExpire $ shadowFlag $ description ) ) olcObjectClasses: {2}( 1.3.6.1.1.1.2.2 NAME 'posixGroup' DESC 'Abstraction o f a group of accounts' SUP top STRUCTURAL MUST ( cn $ gidNumber ) MAY ( use rPassword $ memberUid $ description ) ) olcObjectClasses: {3}( 1.3.6.1.1.1.2.3 NAME 'ipService' DESC 'Abstraction an Internet Protocol service' SUP top STRUCTURAL MUST ( cn $ ipServicePort $ ipServiceProtocol ) MAY description ) olcObjectClasses: {4}( 1.3.6.1.1.1.2.4 NAME 'ipProtocol' DESC 'Abstraction o f an IP protocol' SUP top STRUCTURAL MUST ( cn $ ipProtocolNumber $ descrip tion ) MAY description ) olcObjectClasses: {5}( 1.3.6.1.1.1.2.5 NAME 'oncRpc' DESC 'Abstraction of an ONC/RPC binding' SUP top STRUCTURAL MUST ( cn $ oncRpcNumber $ description ) MAY description ) olcObjectClasses: {6}( 1.3.6.1.1.1.2.6 NAME 'ipHost' DESC 'Abstraction of a host, an IP device' SUP top AUXILIARY MUST ( cn $ ipHostNumber ) MAY ( l $ description $ manager ) ) olcObjectClasses: {7}( 1.3.6.1.1.1.2.7 NAME 'ipNetwork' DESC 'Abstraction of an IP network' SUP top STRUCTURAL MUST ( cn $ ipNetworkNumber ) MAY ( ipNe tmaskNumber $ l $ description $ manager ) ) olcObjectClasses: {8}( 1.3.6.1.1.1.2.8 NAME 'nisNetgroup' DESC 'Abstraction of a netgroup' SUP top STRUCTURAL MUST cn MAY ( nisNetgroupTriple $ memberN isNetgroup $ description ) ) olcObjectClasses: {9}( 1.3.6.1.1.1.2.9 NAME 'nisMap' DESC 'A generic abstrac tion of a NIS map' SUP top STRUCTURAL MUST nisMapName MAY description ) olcObjectClasses: {10}( 1.3.6.1.1.1.2.10 NAME 'nisObject' DESC 'An entry in a NIS map' SUP top STRUCTURAL MUST ( cn $ nisMapEntry $ nisMapName ) MAY de scription ) olcObjectClasses: {11}( 1.3.6.1.1.1.2.11 NAME 'ieee802Device' DESC 'A device with a MAC address' SUP top AUXILIARY MAY macAddress ) olcObjectClasses: {12}( 1.3.6.1.1.1.2.12 NAME 'bootableDevice' DESC 'A devic e with boot parameters' SUP top AUXILIARY MAY ( bootFile $ bootParameter ) ) structuralObjectClass: olcSchemaConfig entryUUID: e21ef9d4-3ec1-1035-9379-7b2d46829542 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20151224194008Z entryCSN: 20151224194008.395577Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20151224194008Z dn: cn={4}openssh-lpk,cn=schema,cn=config objectClass: olcSchemaConfig cn: {4}openssh-lpk olcAttributeTypes: {0}( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey' D ESC 'MANDATORY: OpenSSH Public key' EQUALITY octetStringMatch SYNTAX 1.3.6. 1.4.1.1466.115.121.1.40 ) olcObjectClasses: {0}( 1.3.6.1.4.1.24552.500.1.1.2.0 NAME 'ldapPublicKey' DE SC 'MANDATORY: OpenSSH LPK objectclass' SUP top AUXILIARY MUST ( sshPublicK ey $ uid ) ) structuralObjectClass: olcSchemaConfig entryUUID: e21f52da-3ec1-1035-937a-7b2d46829542 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20151224194008Z entryCSN: 20151224194008.397857Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20151224194008Z dn: cn={5}radius,cn=schema,cn=config objectClass: olcSchemaConfig cn: {5}radius olcAttributeTypes: {0}( 1.3.6.1.4.1.3317.4.3.1.1 NAME 'radiusArapFeatures' D ESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SIN GLE-VALUE ) olcAttributeTypes: {1}( 1.3.6.1.4.1.3317.4.3.1.2 NAME 'radiusArapSecurity' D ESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SIN GLE-VALUE ) olcAttributeTypes: {2}( 1.3.6.1.4.1.3317.4.3.1.3 NAME 'radiusArapZoneAccess' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 S INGLE-VALUE ) olcAttributeTypes: {3}( 1.3.6.1.4.1.3317.4.3.1.44 NAME 'radiusAuthType' DESC 'checkItem: Auth-Type' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466 .115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {4}( 1.3.6.1.4.1.3317.4.3.1.4 NAME 'radiusCallbackId' DES C 'replyItem: Callback-Id' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1 466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {5}( 1.3.6.1.4.1.3317.4.3.1.5 NAME 'radiusCallbackNumber' DESC 'replyItem: Callback-Number' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6 .1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {6}( 1.3.6.1.4.1.3317.4.3.1.6 NAME 'radiusCalledStationId ' DESC 'checkItem: Called-Station-Id' EQUALITY caseIgnoreIA5Match SYNTAX 1. 3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {7}( 1.3.6.1.4.1.3317.4.3.1.7 NAME 'radiusCallingStationI d' DESC 'checkItem: Calling-Station-Id' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {8}( 1.3.6.1.4.1.3317.4.3.1.8 NAME 'radiusClass' DESC 're plyItem: Class' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121 .1.26 ) olcAttributeTypes: {9}( 1.3.6.1.4.1.3317.4.3.1.45 NAME 'radiusClientIPAddres s' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {10}( 1.3.6.1.4.1.3317.4.3.1.9 NAME 'radiusFilterId' DESC 'replyItem: Filter-Id' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466 .115.121.1.26 ) olcAttributeTypes: {11}( 1.3.6.1.4.1.3317.4.3.1.10 NAME 'radiusFramedAppleTa lkLink' DESC 'replyItem: Framed-AppleTalk-Link' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {12}( 1.3.6.1.4.1.3317.4.3.1.11 NAME 'radiusFramedAppleTa lkNetwork' DESC 'replyItem: Framed-AppleTalk-Network' EQUALITY caseIgnoreIA 5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {13}( 1.3.6.1.4.1.3317.4.3.1.12 NAME 'radiusFramedAppleTa lkZone' DESC 'replyItem: Framed-AppleTalk-Zone' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {14}( 1.3.6.1.4.1.3317.4.3.1.13 NAME 'radiusFramedCompres sion' DESC 'replyItem: Framed-Compression' EQUALITY caseIgnoreIA5Match SYNT AX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {15}( 1.3.6.1.4.1.3317.4.3.1.14 NAME 'radiusFramedIPAddre ss' DESC 'replyItem: Framed-IP-Address' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {16}( 1.3.6.1.4.1.3317.4.3.1.15 NAME 'radiusFramedIPNetma sk' DESC 'replyItem: Framed-IP-Netmask' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {17}( 1.3.6.1.4.1.3317.4.3.1.16 NAME 'radiusFramedIPXNetw ork' DESC 'replyItem: Framed-IPX-Network' EQUALITY caseIgnoreIA5Match SYNTA X 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {18}( 1.3.6.1.4.1.3317.4.3.1.17 NAME 'radiusFramedMTU' DE SC 'replyItem: Framed-MTU' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1 466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {19}( 1.3.6.1.4.1.3317.4.3.1.18 NAME 'radiusFramedProtoco l' DESC 'replyItem: Framed-Protocol' EQUALITY caseIgnoreIA5Match SYNTAX 1.3 .6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {20}( 1.3.6.1.4.1.3317.4.3.1.19 NAME 'radiusFramedRoute' DESC 'replyItem: Framed-Route' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4 .1.1466.115.121.1.26 ) olcAttributeTypes: {21}( 1.3.6.1.4.1.3317.4.3.1.20 NAME 'radiusFramedRouting ' DESC 'replyItem: Framed-Routing' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6 .1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {22}( 1.3.6.1.4.1.3317.4.3.1.46 NAME 'radiusGroupName' DE SC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {23}( 1.3.6.1.4.1.3317.4.3.1.47 NAME 'radiusHint' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VA LUE ) olcAttributeTypes: {24}( 1.3.6.1.4.1.3317.4.3.1.48 NAME 'radiusHuntgroupName ' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {25}( 1.3.6.1.4.1.3317.4.3.1.21 NAME 'radiusIdleTimeout' DESC 'replyItem: Idle-Timeout' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4 .1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {26}( 1.3.6.1.4.1.3317.4.3.1.22 NAME 'radiusLoginIPHost' DESC 'replyItem: Login-IP-Host' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1. 4.1.1466.115.121.1.26 ) olcAttributeTypes: {27}( 1.3.6.1.4.1.3317.4.3.1.23 NAME 'radiusLoginLATGroup ' DESC 'replyItem: Login-LAT-Group' EQUALITY caseIgnoreIA5Match SYNTAX 1.3. 6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {28}( 1.3.6.1.4.1.3317.4.3.1.24 NAME 'radiusLoginLATNode' DESC 'replyItem: Login-LAT-Node' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6. 1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {29}( 1.3.6.1.4.1.3317.4.3.1.25 NAME 'radiusLoginLATPort' DESC 'replyItem: Login-LAT-Port' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6. 1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {30}( 1.3.6.1.4.1.3317.4.3.1.26 NAME 'radiusLoginLATServi ce' DESC 'replyItem: Login-LAT-Service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {31}( 1.3.6.1.4.1.3317.4.3.1.27 NAME 'radiusLoginService' DESC 'replyItem: Login-Service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1 .4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {32}( 1.3.6.1.4.1.3317.4.3.1.28 NAME 'radiusLoginTCPPort' DESC 'replyItem: Login-TCP-Port' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6. 1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {33}( 1.3.6.1.4.1.3317.4.3.1.29 NAME 'radiusPasswordRetry ' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {34}( 1.3.6.1.4.1.3317.4.3.1.30 NAME 'radiusPortLimit' DE SC 'replyItem: Port-Limit' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1 466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {35}( 1.3.6.1.4.1.3317.4.3.1.49 NAME 'radiusProfileDn' DE SC '' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE ) olcAttributeTypes: {36}( 1.3.6.1.4.1.3317.4.3.1.31 NAME 'radiusPrompt' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE- VALUE ) olcAttributeTypes: {37}( 1.3.6.1.4.1.3317.4.3.1.50 NAME 'radiusProxyToRealm' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 S INGLE-VALUE ) olcAttributeTypes: {38}( 1.3.6.1.4.1.3317.4.3.1.51 NAME 'radiusReplicateToRe alm' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1. 26 SINGLE-VALUE ) olcAttributeTypes: {39}( 1.3.6.1.4.1.3317.4.3.1.52 NAME 'radiusRealm' DESC ' ' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-V ALUE ) olcAttributeTypes: {40}( 1.3.6.1.4.1.3317.4.3.1.32 NAME 'radiusServiceType' DESC 'replyItem: Service-Type' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4 .1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {41}( 1.3.6.1.4.1.3317.4.3.1.33 NAME 'radiusSessionTimeou t' DESC 'replyItem: Session-Timeout' EQUALITY caseIgnoreIA5Match SYNTAX 1.3 .6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {42}( 1.3.6.1.4.1.3317.4.3.1.34 NAME 'radiusTerminationAc tion' DESC 'replyItem: Termination-Action' EQUALITY caseIgnoreIA5Match SYNT AX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {43}( 1.3.6.1.4.1.3317.4.3.1.35 NAME 'radiusTunnelAssignm entId' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121. 1.26 ) olcAttributeTypes: {44}( 1.3.6.1.4.1.3317.4.3.1.36 NAME 'radiusTunnelMediumT ype' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1. 26 ) olcAttributeTypes: {45}( 1.3.6.1.4.1.3317.4.3.1.37 NAME 'radiusTunnelPasswor d' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {46}( 1.3.6.1.4.1.3317.4.3.1.38 NAME 'radiusTunnelPrefere nce' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1. 26 ) olcAttributeTypes: {47}( 1.3.6.1.4.1.3317.4.3.1.39 NAME 'radiusTunnelPrivate GroupId' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.26 ) olcAttributeTypes: {48}( 1.3.6.1.4.1.3317.4.3.1.40 NAME 'radiusTunnelServerE ndpoint' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.26 ) olcAttributeTypes: {49}( 1.3.6.1.4.1.3317.4.3.1.41 NAME 'radiusTunnelType' D ESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {50}( 1.3.6.1.4.1.3317.4.3.1.42 NAME 'radiusVSA' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {51}( 1.3.6.1.4.1.3317.4.3.1.43 NAME 'radiusTunnelClientE ndpoint' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.26 ) olcAttributeTypes: {52}( 1.3.6.1.4.1.3317.4.3.1.53 NAME 'radiusSimultaneousU se' DESC 'checkItem: Simultaneous-Use' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {53}( 1.3.6.1.4.1.3317.4.3.1.54 NAME 'radiusLoginTime' DE SC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SING LE-VALUE ) olcAttributeTypes: {54}( 1.3.6.1.4.1.3317.4.3.1.55 NAME 'radiusUserCategory' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 S INGLE-VALUE ) olcAttributeTypes: {55}( 1.3.6.1.4.1.3317.4.3.1.56 NAME 'radiusStripUserName ' DESC '' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {56}( 1.3.6.1.4.1.3317.4.3.1.57 NAME 'dialupAccess' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE- VALUE ) olcAttributeTypes: {57}( 1.3.6.1.4.1.3317.4.3.1.58 NAME 'radiusExpiration' D ESC 'checkItem: Expiration' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1. 1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {58}( 1.3.6.1.4.1.3317.4.3.1.59 NAME 'radiusCheckItem' DE SC 'checkItem: $GENERIC$' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.14 66.115.121.1.26 ) olcAttributeTypes: {59}( 1.3.6.1.4.1.3317.4.3.1.60 NAME 'radiusReplyItem' DE SC 'replyItem: $GENERIC$' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.14 66.115.121.1.26 ) olcAttributeTypes: {60}( 1.3.6.1.4.1.3317.4.3.1.61 NAME 'radiusNASIpAddress' DESC '' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 S INGLE-VALUE ) olcAttributeTypes: {61}( 1.3.6.1.4.1.3317.4.3.1.62 NAME 'radiusReplyMessage' DESC 'replyItem: Reply-Message' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1 .4.1.1466.115.121.1.26 ) olcObjectClasses: {0}( 1.3.6.1.4.1.3317.4.3.2.1 NAME 'radiusprofile' DESC '' SUP top AUXILIARY MUST cn MAY ( radiusArapFeatures $ radiusArapSecurity $ radiusArapZoneAccess $ radiusAuthType $ radiusCallbackId $ radiusCallbackNu mber $ radiusCalledStationId $ radiusCallingStationId $ radiusClass $ radiu sClientIPAddress $ radiusFilterId $ radiusFramedAppleTalkLink $ radiusFrame dAppleTalkNetwork $ radiusFramedAppleTalkZone $ radiusFramedCompression $ r adiusFramedIPAddress $ radiusFramedIPNetmask $ radiusFramedIPXNetwork $ rad iusFramedMTU $ radiusFramedProtocol $ radiusCheckItem $ radiusReplyItem $ r adiusFramedRoute $ radiusFramedRouting $ radiusIdleTimeout $ radiusGroupNam e $ radiusHint $ radiusHuntgroupName $ radiusLoginIPHost $ radiusLoginLATGr oup $ radiusLoginLATNode $ radiusLoginLATPort $ radiusLoginLATService $ rad iusLoginService $ radiusLoginTCPPort $ radiusLoginTime $ radiusPasswordRetr y $ radiusPortLimit $ radiusPrompt $ radiusProxyToRealm $ radiusRealm $ rad iusReplicateToRealm $ radiusServiceType $ radiusSessionTimeout $ radiusStri pUserName $ radiusTerminationAction $ radiusTunnelClientEndpoint $ radiusPr ofileDn $ radiusSimultaneousUse $ radiusTunnelAssignmentId $ radiusTunnelMe diumType $ radiusTunnelPassword $ radiusTunnelPreference $ radiusTunnelPriv ateGroupId $ radiusTunnelServerEndpoint $ radiusTunnelType $ radiusUserCate gory $ radiusVSA $ radiusExpiration $ dialupAccess $ radiusNASIpAddress $ r adiusReplyMessage ) ) olcObjectClasses: {1}( 1.3.6.1.4.1.3317.4.3.2.2 NAME 'radiusObjectProfile' D ESC 'A Container Objectclass to be used for creating radius profile object' SUP top STRUCTURAL MUST cn MAY ( uid $ userPassword $ description ) ) structuralObjectClass: olcSchemaConfig entryUUID: e21fabf4-3ec1-1035-937b-7b2d46829542 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20151224194008Z entryCSN: 20151224194008.400137Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20151224194008Z dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend structuralObjectClass: olcDatabaseConfig entryUUID: c2bf1f74-3ec1-1035-8804-6baaf2990e78 creatorsName: cn=config createTimestamp: 20151224193915Z entryCSN: 20151224193915.758030Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20151224193915Z dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern al,cn=auth" manage by * none structuralObjectClass: olcDatabaseConfig entryUUID: c2bf235c-3ec1-1035-8805-6baaf2990e78 creatorsName: cn=config createTimestamp: 20151224193915Z olcRootPW:: redacted olcRootDN: cn=admin,cn=config entryCSN: 20151224194011.381882Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20151224194011Z dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 5 5 olcSpSessionlog: 1000 dn: olcDatabase={1}monitor,cn=config objectClass: olcDatabaseConfig olcDatabase: {1}monitor olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern al,cn=auth" read by dn.base="cn=Manager,dc=my-domain,dc=com" read by * none structuralObjectClass: olcDatabaseConfig entryUUID: c2bf2816-3ec1-1035-8806-6baaf2990e78 creatorsName: cn=config createTimestamp: 20151224193915Z entryCSN: 20151224193915.758251Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20151224193915Z dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap olcDbIndex: objectClass eq,pres olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub structuralObjectClass: olcHdbConfig entryUUID: c2bf2eba-3ec1-1035-8807-6baaf2990e78 creatorsName: cn=config createTimestamp: 20151224193915Z olcRootPW:: redacted olcSuffix: dc=concentricsky,dc=com olcRootDN: cn=manager,dc=concentricsky,dc=com olcAccess: {0}to attrs=userPassword by self write by dn.exact="cn=manager,dc =concentricsky,dc=com" write by dn.exact="uid=ldappwsync,ou=accounts,dc=con centricsky,dc=com,dc=concentricsky,dc=com" write by dn.exact="uid=teamalter ,ou=accounts,dc=concentricsky,dc=com" write by dn.exact="uid=useradd,ou=acc ounts,dc=concentricsky,dc=com" write by dn.exact="uid=replication,ou=accoun ts,dc=concentricsky,dc=com,dc=concentricsky,dc=com" read by anonymous auth by * read olcAccess: {1}to attrs=sshPublicKey by self write by dn.exact="cn=manager,dc =concentricsky,dc=com" write by dn.exact="uid=keysync,ou=accounts,dc=concen tricsky,dc=com" write by dn.exact="uid=teamalter,ou=accounts,dc=concentrics ky,dc=com" write by dn.exact="uid=useradd,ou=accounts,dc=concentricsky,dc=c om" write by dn.exact="uid=replication,ou=accounts,dc=concentricsky,dc=com, dc=concentricsky,dc=com" read by * read olcAccess: {2}to * by self write by anonymous auth by dn.exact="cn=manager,d c=concentricsky,dc=com" write by dn.exact="uid=teamalter,ou=accounts,dc=con centricsky,dc=com" write by dn.exact="uid=useradd,ou=accounts,dc=concentric sky,dc=com" write by dn.exact="uid=replication,ou=accounts,dc=concentricsky ,dc=com,dc=concentricsky,dc=com" read by users read by * none olcAccess: {3}to dn.base="dc=concentricsky,dc=com" by self write by anonymou s auth by dn.exact="cn=manager,dc=concentricsky,dc=com" write by dn.exact=" uid=replication,ou=accounts,dc=concentricsky,dc=com,dc=concentricsky,dc=com " read by dn.exact="uid=teamalter,ou=accounts,dc=concentricsky,dc=com" writ e by dn.exact="uid=useradd,ou=accounts,dc=concentricsky,dc=com" write by gr oup.exact="cn=it,ou=groups,dc=concentricsky,dc=com" write by users read by * none entryCSN: 20151224194011.395722Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20151224194011Z dn: olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 5 5 olcSpSessionlog: 1000 On Mon, Jun 8, 2020 at 10:13 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Monday, June 8, 2020 10:27 AM -0700 John Alexander > <jalexander(a)concentricsky.com> wrote: > > > Here is the contents of cn=module{0}.ldif > > Given that the results differ between ldapsearch and the actual > cn=module{0} LDIF file, it would appear you've managed to thoroughly break > cn=config such that it's failing to properly update the files on disk. > > You've never provided full output of your cn=config db from slapcat, so > it's difficult to determine how you've ended up in that state (if the > config db even fully captures what went wrong). > > You'll likely need to export what you have via slapcat, fix the module > load > section and any other problems, and rebuild your cn=config db with that > fixed export. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > -- John Alexander Systems Administrator E: jalexander(a)concentricsky.com Concentric Sky, Inc https://www.concentricsky.com

2 1

ldap utils doesn't use _ldaps._tcp SRV entry when connecting using ldaps:///
by Braiam 08 Jun '20

08 Jun '20

Hi, I've configured correctly my DNS to provide SRV records for my ldap servers. If I use ldap:/// , it would correctly use the entry corresponding to _ldap._tcp to make the connection: ldapsearch -H ldap:///dc%3Dexample%2Cdc%3Dcom -v ldap_initialize( ldap://ldap.example.com:389 ) But if I use ldaps it would try to use _ldap entry instead of _ldaps. Is there a way I can avoid this? -- Braiam

2 1

Re: [EXT] Re: ppolicy: attempting to load ppolicy module
by John Alexander 08 Jun '20

08 Jun '20

Apologies Quanah, Yes - the first thing I did was to load the ppolicy schema. Here is the full cn=module{0} from ldapsearch: # module{0}, config dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib64/openldap olcModuleLoad: {0}back_bdb olcModuleLoad: {1}syncprov olcModuleLoad: {2}ppolicy Here is the contents of cn=module{0}.ldif dn: cn=module{0} objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib64/openldap olcModuleLoad: {0}back_bdb olcModuleLoad: {1}syncprov I don't have the initial error that I got when attempting to load the ppolicy module, but subsequent attempts yield this error: add olcModuleLoad: ppolicy modifying entry "cn=module{0},cn=config" ldap_modify: Type or value exists (20) additional info: modify/add: olcModuleLoad: value #0 already exists Then after (ill-advisedly) applying the ppolicy overlay, slapcat -n 0 yields the following: 5ede54b5 UNKNOWN attributeDescription "OLCPPOLICYDEFAULT" inserted. 5ede54b5 config error processing olcOverlay={1}ppolicy,olcDatabase={2}hdb,cn=config: slapcat: bad configuration file! Thank you, John Alexander On Mon, Jun 8, 2020 at 9:12 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Monday, June 8, 2020 9:55 AM -0700 John Alexander > <jalexander(a)concentricsky.com> wrote: > > > > > > > Hi Quanah, > > > > > > I figured that was the problem, but after I ran the module load: > > > > > > dn: cn=module{0},cn=config > > changetype: modify > > add: olcModuleLoad > > olcModuleLoad: ppolicy > > > > > > I received errors. slapcat -n 0 | grep olcModuleLoad did not indicate > > that ppolicy was loaded. However ldapsearch indicated that it was > > loaded. > > If you receive errors, you need to show what those errors are. You also > need to show what your *full* cn=module{0} entry looks like, and you've > never stated whether or not you've loaded the mandatory ppolicy schema. > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > -- John Alexander Systems Administrator E: jalexander(a)concentricsky.com Concentric Sky, Inc https://www.concentricsky.com

3 3

Re: [EXT] Re: ppolicy: attempting to load ppolicy module
by John Alexander 08 Jun '20

08 Jun '20

Hi Quanah, I figured that was the problem, but after I ran the module load: dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: ppolicy I received errors. slapcat -n 0 | grep olcModuleLoad did not indicate that ppolicy was loaded. However ldapsearch indicated that it was loaded. I expect that first, I need to remove the ppolicy overlay, but am not sure how to accomplish that. I would be grateful for any guidance. John Alexander On Mon, Jun 8, 2020 at 8:36 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Monday, June 8, 2020 9:16 AM -0700 John Alexander > <jalexander(a)concentricsky.com> wrote: > > > > > > 5ede54b5 UNKNOWN attributeDescription "OLCPPOLICYDEFAULT" inserted. > > 5ede54b5 config error processing > > olcOverlay={1}ppolicy,olcDatabase={2}hdb,cn=config: > > slapcat: bad configuration file! > > > > > > > > > > I assume this is because there is no olcModuleLoad attribute in the ldif > > for ppolicy. Would it be appropriate to remove the > > olcOverlay={1}ppolicy,oldDatabase={2}hdb.ldif file - since by my > > understanding ldapdelete does not work against cn=config > > You must moduleload the ppolicy module before you can instantiate ppolicy > against a database backend. > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > -- John Alexander Systems Administrator E: jalexander(a)concentricsky.com Concentric Sky, Inc https://www.concentricsky.com

2 1

Antw: [EXT] Re: ppolicy: attempting to load ppolicy module
by Ulrich Windl 08 Jun '20

08 Jun '20

>>> "John Alexander" <jalexander(a)concentricsky.com> schrieb am 06.06.2020 um 18:45 in Nachricht <17901_1591478669_5EDC098C_17901_24_1_20200606164545.849.61910(a)hypatia.openldap. rg>: > Hi Howard, > > Well, that is interesting. > > [root@ldap3 ~]# ldapsearch -x -b cn=module{0},cn=config -H ldapi:/// > # extended LDIF > # > # LDAPv3 > # base <cn=module{0},cn=config> with scope subtree > # filter: (objectclass=*) > # requesting: ALL > # > > # search result > search: 2 > result: 32 No such object Could it be that your user is not allowed to search/list that object? > > Would this indicate that LDAP does not think that there are any modules > loaded? slapcat -n 0 | grep olcModuleLoad shows > olcModuleLoad: {0}back_bdb > olcModuleLoad: {1}syncprov > > I'm out of my depth on path forward now. > > John Alexander

3 2

Remove/change replication partner
by Jean-Luc Chandezon 08 Jun '20

08 Jun '20

Hello, I'm trying to remove replication partner (olcSyncrepl overlay). Here are results for partner parameter(config): # ldapsearch -LLLY external -H ldapi:/// -b "olcDatabase={0}config,cn=config" olcSyncRepl SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: olcDatabase={0}config,cn=config olcSyncrepl: {0}rid=01 provider=ldap://bea-olp-001.lan-explore.fr binddn=" cn=replication,dc= lan-explore,dc=fr" bindmethod=simple credentials=i2Df 0rXiQokb8HtYZemJ searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=02 provider=ldap://cdb-olp-001. lan-explore.fr binddn=" cn=replication,dc= lan-explore,dc=fr" bindmethod=simple credentials=i2Df 0rXiQokb8HtYZemJ searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config dn: olcOverlay={1}syncprov,olcDatabase={0}config,cn=config dn: olcOverlay={2}syncprov,olcDatabase={0}config,cn=config I tested this query: dn: olcDatabase={0}config,cn=config changetype: modify delete: olcSyncrepl The result is: ldapmodify -Y EXTERNAL -H ldapi:/// -f removeConfigPartner.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={0}config,cn=config" ldap_modify: Server is unwilling to perform (53) additional info: shadow context; no update referral Please what I missed? Thanks, Jean-Luc

3 11

Re: Antw: [EXT] Re: Unexpected LMDB RSS /performance difference on similar machines
by Howard Chu 08 Jun '20

08 Jun '20

Ulrich Windl wrote: >>>> Howard Chu <hyc(a)symas.com> schrieb am 07.06.2020 um 22:44 in Nachricht > <14412_1591562670_5EDD51AD_14412_294_1_79b319e0-fa23-a622-893b-b1b558a9385c@syma > .com>: >> Alec Matusis wrote: >>> 2. dd reads the entire environment file into system file buffers (93GB). >> Then when the entire environment is cached, I run the binary with >> MDB_NORDAHEAD, but now it reads 80GB into shared memory, like when >> MDB_NORDAHEAD is not set. Is this expected? Can it be prevented? >> >> It's not reading anything, since the data is already cached in memory. >> >> Is this expected? Yes - the data is already present, and LMDB always >> requests a single mmap for the entire size of the environment. Since >> the physical memory is already assigned, the mmap contains it all. >> >> Can it be prevented - why does it matter? If any other process needs >> to use the RAM, it will get it automatically. > > While reading this: The amount of memory could suggest that using the > hugepages feature could speed up things, especially if most of the mmapped data > is expected to reside in RAM. Hugepages need to be enabled using > vm.nr_hugepages=... in /etc/sysctl.conf (or corresponding). However I don't > know whether LMDB can use them. > > A current AMD CPU offers these page sizes: 4k, 2M, and 1G, but some VMs (like > Xen) can't use it. On the system I see, hugepages are 2MB on size. I don't know > what the internal block size of LMDB is, but likely it would benefit to match > the hugepage size if using it... https://git.openldap.org/openldap/openldap/-/blob/13f3bcd59c2055d53e4759b0c… We have already had this discussion, and your suggestion was irrelevant back then too. https://www.openldap.org/lists/openldap-technical/201401/msg00213.html Please stop posting disinformation. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Unexpected LMDB RSS /performance difference on similar machines
by Alec Matusis 07 Jun '20

07 Jun '20

We have encountered an unexpected performance impact only by moving an LMDB to a different linux machine with similar hardware characteristics. We have a 93GB LMDB environment with 3 databases. The database in question is 13GB. The test executable loops over key/value pairs in the 13GB database with a read-only cursor. For the same executable, we observe two different behaviors on different machines (the same lmdb environment was copied to the machines with scp). First machine has 148GB RAM and the second has 105GB RAM and the same CPU. The expected and desired behavior on linux kernel 3.13 / eglibc 2.19 shows that the process takes 13GB of shared memory (seen by top and confirmed with /proc/<pid>/smaps below)). In the alternate behavior on kernel 4.15 / glibc 2.27 the process reads from disk 83GB into shared memory (which takes 16 minutes instead of 8 minutes on the correct machine in the corresponding initial runs). /proc/<pid>/smaps Machine with expected behavior: 7f3595da8000-7f4cde517000 r--s 00000000 fb:10 6442473002 /fusionio1/lmdb/db.0/dbgraph/data.mdb Size: 97656252 kB Rss: 13203648 kB Pss: 13203648 kB Shared_Clean: 0 kB Shared_Dirty: 0 kB Private_Clean: 13203648 kB Private_Dirty: 0 kB Referenced: 13203648 kB Anonymous: 0 kB AnonHugePages: 0 kB Swap: 0 kB KernelPageSize: 4 kB MMUPageSize: 4 kB Locked: 0 kB VmFlags: rd sh mr mw me ms sd Machine with excessive Rss and slower read time: 7f55990aa000-7f6ce1819000 r--s 00000000 fc:02 7077908 /lmdbguest/lmdb/db.0/dbgraph/data.mdb Size: 97656252 kB KernelPageSize: 4 kB MMUPageSize: 4 kB Rss: 82587036 kB Pss: 82587036 kB Shared_Clean: 0 kB Shared_Dirty: 0 kB Private_Clean: 82587036 kB Private_Dirty: 0 kB Referenced: 82587036 kB Anonymous: 0 kB LazyFree: 0 kB AnonHugePages: 0 kB ShmemPmdMapped: 0 kB Shared_Hugetlb: 0 kB

2 6

ppolicy: attempting to load ppolicy module
by jalexander＠concentricsky.com 06 Jun '20

06 Jun '20

I have an OpenLDAP server on CentOS 7.8 and am trying to get the ppolicy overlay loaded. I'm attempting to load in the module with this command: ldapmodify -Y EXTERNAL -H ldapi:/// -f ppolicy_load.ldif and I get this error: add olcModuleLoad: ppolicy modifying entry "cn=module{0},cn=config" ldap_modify: Type or value exists (20) additional info: modify/add: olcModuleLoad: value #0 already exists The contents of ppolicy.ldif: dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: ppolicy cn=module{0},cn=config.ldif contents: dn: cn=module{0} objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib64/openldap olcModuleLoad: {0}back_bdb olcModuleLoad: {1}syncprov Can anyone provide guidance on how to get this working? I configured this on test servers that I derived from my main ldap server with no problem.

3 3

pwdChangedTime not defined when creating new entry
by Manuela Mandache 05 Jun '20

05 Jun '20

Hello all, We have a directory running on OpenLDAP 2.4.44 with the ppolicy overlay on the main database. When a new entry with a userPassword defined is created, pwdChangedTime is not defined, so this initial userPassword never expires. The directory has been migrated from its OpenLDAP 2.3.34 instance (yes, we missed some steps...), and there the pwdChangedTime is set, and naturally equal to createTimestamp. The overlay is configured as follows: dn: olcOverlay={2}ppolicy,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: {2}ppolicy olcPPolicyDefault: ou=ppolicy,dc=example,dc=com olcPPolicyHashCleartext: TRUE olcPPolicyUseLockout: TRUE Is there a parameter I missed which would switch on setting pwdChangedTime at entry creation? Do I have to provide some other configuration elements? Or is it unreasonable to expect this initialisation of the attribute this way, and only a password change can set it? I think the setting at creation is rather handy... Using pwdMustChange would be difficult, we have a lot of client apps which would be forced to check and probably adapt their authentication procedures. Thank you and regards, Manuela Sent with [ProtonMail](https://protonmail.com) Secure Email.

5 11

Re: ssl certificate chain
by Dale Thompson - NOAA Federal 04 Jun '20

04 Jun '20

I'm not certain the hack redhat added to force openldap to use nss actually causes openldap to use the nss cert store. My rhel6 openldap servers appear to just use the PEM certs they would have used as if redhat never messed with forcing openldap to use nss, but rather left it at openssl. I did check and slapd is linked against the nss libs, but using the pem file in /etc/openldap/cacerts. The fix for this might be as simple as linking the PEM version of the updated cert store into the directory where openldap is looking. On Wed, Jun 3, 2020 at 11:32 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Wednesday, June 3, 2020 8:15 PM +0300 Леонид Юрьев > <leo(a)yuriev.ru> wrote: > > > Seems this is > > https://www.agwa.name/blog/post/fixing_the_addtrust_root_expiration. > > Since RHEL6 is in use here, specifically see the linked tweet for > Fedora/RHEL in the above post. > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > -- Dale James Thompson, NWS Radar Operations Center IT Specialist, Configuration Management Team 1313 Halley Circle Norman, OK 73069 Voice (405) 573-3472 Fax (405) 573-3480 Dale.J.Thompson(a)noaa.gov

4 3

userPassword is not replicated
by razvanpopescu＠hotmail.com 04 Jun '20

04 Jun '20

Hi, I have set up a replication master/slave between 2 openldap 2.4.44 on rhel 7.x. On the slave server, the userPassword attribute is not replicated by syncrepl, all other attributes are replicated OK The replication has been set up as follow: On master server (provider), I have set up : # replication moduleload syncprov overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 On slave server (consumer), I've set up in the /etc/openldap/slapd.conf: # replication syncrepl rid=100 provider=ldaps://fr-te-ldap-x1.intra.commercial-union.fr type=refreshAndPersist searchbase="dc=aviva,dc=fr" scope=sub schemachecking=on bindmethod=simple filter="(objectClass=*)" binddn="cn=admin,dc=aviva,dc=fr" credentials=redhat retry="15 +" index entryUUID,entryCSN eq sizelimit 100000 On both server ( master, slave) , the ACL has been set up as follow : access to attrs=userPassword by self write by anonymous auth by * read access to * by self read by users read by anonymous read Please help me ! What is wrong in this configuration and why the userPassword attribute is not replicated on slave side ? Please advice me, Thank, Razvan

5 16

ssl certificate chain
by phei＠isc.upenn.edu 03 Jun '20

03 Jun '20

Not sure if this is an openldap issue but have to examine everything we can. We revised our nss certificate store as part of addressing the expiration of our root cert. It now has two certs, the end service cert and the intermediate. Basic client operations (ldapsearch) work fine; using -d1 shows that the appropriate service certificate is loaded and the the search is successful. But if we run an 'openssl s_client -showcerts' against the host and port 636, we continue to see the expired root certificate even though it's not in the nss store configured chain. This is causing issues for some applications (mainly java based) so we're just trying to understand where the expired root would be coming from if it's not in the openldap server configuration. Thanks, Peter relevant bits: #slapd.conf # TLS/ssl TLSCACertificatePath /etc/openldap/certs TLSCertificateFile DirectoryLdap #sudo certutil -d /etc/openldap/certs -L Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI intermediate-2024 ,, PennGroupsLdap #sudo certutil -d /etc/openldap/certs -L -n PennGroupsLdap Certificate: Data: Version: 3 (0x2) Serial Number: 2b:27:6c:70:ac:b4:5c:3d:11:05:17:d9:15:59:24:af Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption Issuer: "CN=InCommon RSA Server CA,OU=InCommon,O=Internet2,L=Ann Arbo r,ST=MI,C=US" Validity: Not Before: Tue Feb 05 00:00:00 2019 Not After : Thu Feb 04 23:59:59 2021 Subject: "CN=penngroups-dev.net.isc.upenn.edu,OU=ISC: N&T - NES - Ide ntity and Access Management (IAM),O=University of Pennsylvania,ST REET=3451 Walnut Street,L=Philadelphia,ST=PA,postalCode=19104,C=U S" *snip* #sudo certutil -d /etc/openldap/certs -L -n intermediate-2024 Certificate: Data: Version: 3 (0x2) Serial Number: 47:20:d0:fa:85:46:1a:7e:17:a1:64:02:91:84:63:74 Signature Algorithm: PKCS #1 SHA-384 With RSA Encryption Issuer: "CN=USERTrust RSA Certification Authority,O=The USERTRUST Net work,L=Jersey City,ST=New Jersey,C=US" Validity: Not Before: Mon Oct 06 00:00:00 2014 Not After : Sat Oct 05 23:59:59 2024 Subject: "CN=InCommon RSA Server CA,OU=InCommon,O=Internet2,L=Ann Arb or,ST=MI,C=US" *snip* gather the openssl s_client info; why are 4 certs (depth 0->3) presented instead of the expected 2 (dept h0->1)? #openssl s_client -host localhost -port 636 -showcerts 2>local.certs >> local.certs #grep -A1 "s:" local.certs 0 s:/C=US/postalCode=19104/ST=PA/L=Philadelphia/street=3451 Walnut Street/O=University of Pennsylvania/OU=ISC: N&T - NES - Identity and Access Management (IAM)/CN=penngroups-dev.net.isc.upenn.edu i:/C=US/ST=MI/L=Ann Arbor/O=Internet2/OU=InCommon/CN=InCommon RSA Server CA -- 1 s:/C=US/ST=MI/L=Ann Arbor/O=Internet2/OU=InCommon/CN=InCommon RSA Server CA i:/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority -- 2 s:/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root -- 3 s:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root 0 s:/C=US/postalCode=19104/ST=PA/L=Philadelphia/street=3451 Walnut Street/O=University of Pennsylvania/OU=ISC: N&T - NES - Identity and Access Management (IAM)/CN=penngroups-dev.net.isc.upenn.edu i:/C=US/ST=MI/L=Ann Arbor/O=Internet2/OU=InCommon/CN=InCommon RSA Server CA -- 1 s:/C=US/ST=MI/L=Ann Arbor/O=Internet2/OU=InCommon/CN=InCommon RSA Server CA i:/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority -- 2 s:/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root -- 3 s:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root

7 8

olcAccess from b64 to plaintext
by Giuseppe De Marco 31 May '20

31 May '20

Hi guys, I wrote this simple script to have human readable olaAccess lists https://github.com/peppelinux/slapd_acl hope you'll enjoy -- ____________________ Dott. Giuseppe De Marco CENTRO ICT DI ATENEO University of Calabria 87036 Rende (CS) - Italy Phone: +39 0984 496961 e-mail: giuseppe.demarco(a)unical.it -- ------------------------------------------------------------------------------------------------------------------ Il banner è generato automaticamente dal servizio di posta elettronica dell'Università della Calabria <https://www.unical.it/portale/portaltemplates/view/view.cfm?100061>

1 0

what does "error 131 (State not recoverable)" indicate?
by James Anderson 30 May '20

30 May '20

good evening; i am looking for an explanation for a situation which we encountered with an lmdb database and library version is 0.9.17-3. the database's condition was such that all attempts to open it for reading failed. in at least some cases the error appears to have occurred during the operation which looked for stale leaders. a problem was also evident when attempting to copy the database: @nl12:~# mdb_copy /srv/dydra/catalog/repositories/d2141030-9495-c040-b1a7-9e19edbeb491/ /srv/dydra/backups/public-data__rev mdb_copy: copying failed, error 131 (State not recoverable) it was first evident in running processes which had already had the database open, but of which new threads were reopening the database environment. the only thing remarkable about the circumstances involved might have been that while several dozen threads were preparing reading simultaneously and in the processes of opening the environment to read, a monitoring thread took a snapshot of the threads, which entailed interrupting each to generate its stack trace. once we identified and terminated all processes which had the environment open, successive open attempts succeeded. when we examined the content, however, although the space was still occupied on disk and the transaction id reflected the prior content, the indices were empty. - what condition does that message intend to describe? - what can cause that condition? - would there have been some way to have recovered the old state - despite that message?

3 6

Antw: [EXT] LMDB does not recover on restart.
by Ulrich Windl 29 May '20

29 May '20

>>> Vipul Jain <vipul5798(a)gmail.com> schrieb am 28.05.2020 um 15:51 in Nachricht <15586_1590677913_5ECFD199_15586_106_1_CALsDq61nAgNh1Z3eUK=CNk_b7uWXgQ6aZYOzQvsn G-DPXQd2g(a)mail.gmail.com>: > In standalone application, I have insert 10 key,value using LMDB. > but if application crash and restart, and then I am trying to access the > same LMDB DB file, I am not able to see any data. it give error violating > memory access. Did the application commit the data before crash? > Any solution for this? > > I am looking for LMDB persistence, On restart of application do not need to > push key value again in LMDB. > > -- > with regards:- > Vipul Jain

2 1

LMDB does not recover on restart.
by Vipul Jain 28 May '20

28 May '20

In standalone application, I have insert 10 key,value using LMDB. but if application crash and restart, and then I am trying to access the same LMDB DB file, I am not able to see any data. it give error violating memory access. Any solution for this? I am looking for LMDB persistence, On restart of application do not need to push key value again in LMDB. -- with regards:- Vipul Jain

1 0

ReviewBoard LDAP authentication issue
by Adam Weremczuk 26 May '20

26 May '20

Hi all, I'm running old samba4 DC and trying to set up LDAP authentication for https://www.reviewboard.org/docs/manual/3.0/admin/configuration/authenticat… These settings are almost working for me: -> Authentication Method: LDAP -> LDAP Server: ldap://192.168.x.x:389 -> Review Board LDAP Bind Account: cn=auth,cn=Users,dc=domain,dc=co,dc=uk -> Review Board LDAP Bind Password: ******** -> LDAP Base DN: cn=Users,dc=domain,dc=co,dc=uk -> Username Attribute: uid -> Given Name Attribute: givenName -> Surname Attribute: sn -> Full Name Attribute: cn -> E-Mail LDAP Attribute: mail -> E-Mail Domain: (blank) -> Custom LDAP User Search Filter: (blank) I have a weird problem with about half of users being able to log in: 2020-05-26 11:32:07,623 - DEBUG - - root - Attempting to authenticate user DN "CN=dummy1,CN=Users,DC=domain,DC=co,DC=uk" (username dummy1) in LDAP and half unable: 2020-05-26 11:40:57,671 - ERROR - - root - Unexpected error authenticating user "dummy2" in LDAP: 'NoneType' object has no attribute 'decode' After ruling out the obvious such as AD groups membership and primary groups I compared ldapsearch dumps: ldapsearch -D 'admin(a)domain.co.uk' -b 'cn=Users,dc=domain,dc=co,dc=uk' -H ldap://192.168.x.x -W sAMAccountName=dummy I've noticed that all of those who cannot log in are missing msSFU30Name and msDS-SupportedEncryptionTypes attributes. I've added them to match settings for the successful users as below: dummy2.ldif dn: CN=dummy2,CN=Users,DC=domain,DC=co,DC=uk changetype: modify add: msSFU30Name msSFU30Name: dummy2 add: msDS-SupportedEncryptionTypes msDS-SupportedEncryptionTypes: 0 ldbmodify -H /var/lib/samba/private/sam.ldb dummy2.ldif -U dummy2 Modified 1 records successfully Unfortunately it didn't help :( Any ideas why? Thanks, Adam

1 0

replication issue. Incorrect ACL?
by Gao 20 May '20

20 May '20

Hello, We have two Openldap server in master-slave replication. I just found that a replication issue on the slave and I think it is ACL related. Few weeks ago I added ACL on the master (ldap-01) to allow user change their own password: dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap olcDbIndex: objectClass eq,pres olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: loginShell eq olcDbIndex: uid eq,pres,sub olcDbIndex: memberUid eq,pres,sub olcDbIndex: uniqueMember eq,pres olcDbIndex: sambaSID eq olcDbIndex: sambaPrimaryGroupSID eq olcDbIndex: sambaGroupType eq olcDbIndex: sambaSIDList eq olcDbIndex: sambaDomainName eq olcDbIndex: default sub structuralObjectClass: olcHdbConfig entryUUID: 3b7e5722-d26f-1035-7735-91213c5bb357 creatorsName: cn=config createTimestamp: 20160629180122Z olcSuffix: dc=van,dc=company,dc=com olcRootDN: cn=Manager,dc=van,dc=company,dc=com olcRootPW:: e1NTSEF9cEpWbEIzOEh4UXJpcjnvSUl2enZzWTF1akt4Nnd6OTk= olcAccess: {0}to attrs=userPassword by self write by anonymous auth by dn.ba se="cn=Manager,dc=van,dc=company,dc=com" write by * none olcAccess: {1}to * by self write by dn="cn=Manager,dc=van,dc=company,dc= com" write by * read entryCSN: 20200504150528.806636Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20200504150528Z Now I found on the slave(ldap-03) all userPassword attributes is disappeared. So I think the ACL may blocked the replication. I think I need add the replication user (rpuser) to the ACL on the master and allow the rpuser read(or RW?) access. Could someone check my ACL and see if my guess is correct? If so then how do I add (or append?) the ACL to allow replication of the userPassword? Thank you in advance. Gao

3 5

Antw: [EXT] Re: replication issue. Incorrect ACL?
by Ulrich Windl 20 May '20

20 May '20

>>> Andreas Hasenack <andreas(a)canonical.com> schrieb am 20.05.2020 um 15:04 in Nachricht <17575_1589979873_5EC52AE0_17575_76_1_CANYNYEHQ0+sBtbuO8zDKcaZChDxPPB6WC0tWabWWM yLgVtkYA(a)mail.gmail.com>: >> olcRootDN: cn=Manager,dc=van,dc=company,dc=com >> olcRootPW:: e1NTSEF9cEpWbEIzOEh4UXJpcjnvSUl2enZzWTF1akt4Nnd6OTk= > > You should change that password now, since you just shared its SSHA > hash to the world ;) ...what makes me wonder how long it takes these days to create a valid password from a salted SHA-1 hash... [...]

2 1

Disable overlays
by Jean-Luc Chandezon 18 May '20

18 May '20

Hello, I don't how to disable overlays (ppolicy or sync for example). Is it possible? Thanks, Jean-Luc

2 1

"GSSAPI Error: No credentials were supplied ... unknown mech-code 0 for mech unknown"
by Braiam 15 May '20

15 May '20

Hi, I'm trying to get slapd to use heimdal kerberos to provide a single authentication backend for my network. I've followed the Administrator's Guide on SASL[1] and cyrus faq entry about connecting OpenLDAP with GSSAPI[2]. I'm stuck at the what I believe is a misunderstanding from my part. I believe when I use -Y GSSAPI I should be using my braiam/admin credentials, but according to SASL facility in slapd I'm not providing any. strace confirms that it reads the /tmp/krb5cc_1000 file correctly. I'm very confused as to how to proceed since most of the relevant results point to having not kinit'd. I'm using Debian stable, slapd=2.4.47+dfsg-3+deb10u1, libsasl2-modules-gssapi-heimdal=2.1.27+dfsg-1+deb10u1. debian@ldap01:~$ sudo ktutil -k /etc/krb5.keytab list /etc/krb5.keytab: Vno Type Principal Aliases 4 aes256-cts-hmac-sha1-96 host/ldap01.example.com(a)EXAMPLE.COM 4 des3-cbc-sha1 host/ldap01.example.com(a)EXAMPLE.COM 4 arcfour-hmac-md5 host/ldap01.example.com(a)EXAMPLE.COM 9 aes256-cts-hmac-sha1-96 ldap/ldap01.example.com(a)EXAMPLE.COM 9 des3-cbc-sha1 ldap/ldap01.example.com(a)EXAMPLE.COM 9 arcfour-hmac-md5 ldap/ldap01.example.com(a)EXAMPLE.COM debian@ldap01:~$ klist Credentials cache: FILE:/tmp/krb5cc_1000 Principal: braiam/admin(a)EXAMPLE.COM Issued Expires Principal May 12 20:34:05 2020 May 13 20:34:05 2020 krbtgt/EXAMPLE.COM(a)EXAMPLE.COM May 12 20:34:11 2020 May 13 20:34:05 2020 ldap/ldap01.example.com(a)EXAMPLE.COM debian@ldap01:~$ ldapsearch -LLL -Y GSSAPI -s "base" -b "" supportedSASLMechanisms -H $ldap_host SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80) additional info: SASL(-1): generic failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible. (unknown mech-code 0 for mech unknown) [1]: http://www.openldap.org/doc/admin24/sasl.html [2]: https://www.cyrusimap.org/sasl/sasl/faqs/openldap-sasl-gssapi.html -- Braiam

3 4

Help for setting-up an ldap-proxy
by lists＠zxt10d.de 14 May '20

14 May '20

Hello, I'm pretty new to this list, and maybe/hopefully someone could help ... I work at a chair at a german university, and we would like to use the central AD of theat university for our chair - by using a ldap-proxy system, so that there's only one connection to the central AD, and not ~70 (all of our computers, etc.). I can search the AD by using this (modified) command: ldapsearch -LLL "(cn=FIRSTNAME LASTNAME)" -H ldaps://ldap.UNIVERSITY.de -b dc=university,dc=de -D cn=special,ou=group,dc=university,dc=de -W For locally installed applications I can use this /etc/pam_ldap.conf: uri ldaps://ldap.university.de host ldap.university.de base ou=group,ou=hosts,dc=university,dc=de ldap_version 3 binddn cn=special,ou=group,dc=university,dc=de bindpw password pam_password crypt ssl start_tls ssl on To set-up the local ldap-proxy, I tried to follow this description, but it won't work (and I guess its not realy correct, as the config-file is there twice): https://doc.owncloud.com/server/admin_manual/configuration/ldap/ldap_proxy_… When running "slaptest -f /etc/ldap/slapd.conf" I get these errors: 5ebd3ec5 /etc/ldap/slapd.conf: line 102: warning, source attributeType 'dn' should be defined in schema 5ebd3ec5 PROXIED attributeDescription "DN" inserted. 5ebd3ec5 hdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap: (2). Expect poor performance for suffix "ou=group,ou=hosts,dc=university,dc=de". 5ebd3ec5 hdb_db_open: database "ou=lsafp,ou=hosts,dc=university,dc=de": db_open(/var/lib/ldap/id2entry.bdb) failed: No such file or directory (2). 5ebd3ec5 backend_startup_one (type=hdb, suffix="ou=group,ou=hosts,dc=university,dc=de"): bi_db_open failed! (2) 5ebd3ec5 backend_startup_one (type=ldap, suffix="ou=group,ou=hosts,dc=university,dc=de"): bi_db_open failed! (2) slap_startup failed (test would succeed using the -u switch) Now my questions: - where and how to put the data to do a query versus the central AD? (binddn & bindpw part) - where to define the local ldap-database? (I guess that has to be created an will be filled automatically...?) The system I'm using is a Debian 10.4 one. slapd -V: @(#) $OpenLDAP: slapd (Apr 20 2020 18:19:54) $ Debian OpenLDAP Maintainers <pkg-openldap-devel(a)lists.alioth.debian.org> Sorry, english is not my native language ... Thanks a lot for reading! ;) Cheers, Torsten

1 0

Can't get LDAPS connection with OpenLDAP as a Proxy working (error:14090086)
by a.leurs＠consense-gmbh.de 13 May '20

13 May '20

Hello, I'm farely now to OpenLDAP. I have successfully build a connection to an Windows Active Directory with LDAP over Port 389. But when I switch to LDAPS and Port 636 and try a connection via the Softerra LDAP Browser I get the following error: TLS certificate verification: Error, unable to get local issuer certificate TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (unable to get local issuer certificate). I have installed the certificate of the Server I want to connect to on my machine. But I still get this error. Does anyone have an idea why this error happens? Here is my slapd.conf-File: # MDB Backend configuration file # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. ucdata-path ./ucdata include ./schema/core.schema include ./schema/cosine.schema include ./schema/nis.schema include ./schema/inetorgperson.schema #include ./schema/openldap.schema #include ./schema/dyngroup.schema pidfile ./run/slapd.pid argsfile ./run/slapd.args loglevel 256 sizelimit unlimited timelimit unlimited ####################################################################### # mdb database definitions ####################################################################### database meta suffix "dc=example,dc=com" uri "ldaps://dc001.example.com:636/DC=example,DC=com"

2 1

Ldap attribute error
by Technology Server 11 May '20

11 May '20

Dear, After trying to reset LDAP user password , we are getting the following error. main[9834]: conn=4965799 op=1 MOD dn="uid=########################################" main[9834]: conn=4965799 op=1 MOD attr=userPassword [9834]: conn=4965799 op=1 RESULT tag=103 err=17 text=entry update failed [9834]: conn=4965799 fd=16 closed (connection lost) error 17 is receiving for other attribute also which are already defined. Can you please suggest on this issue?

3 2

ldapmodify: ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80)
by nisgopee＠gmail.com 07 May '20

07 May '20

Commad: ldapmodify -Y external -H ldapi:/// -f enable-ldap-log.ldif Returns: SASL/EXTERNAL authentication started ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80) # cat enable-ldap-log.ldif dn: cn=config changeType: modify add: olcLogLevel olcLogLevel: stats # ldapmodify -Y external -H ldapi:/// -f enable-ldap-log.ldif -d1 ldap_url_parse_ext(ldapi:///) ldap_create ldap_url_parse_ext(ldapi:///??base) ldap_sasl_interactive_bind_s: user selected: external ldap_int_sasl_bind: external ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_path ldap_new_socket: 4 ldap_connect_to_path: Trying /var/run/ldapi ldap_connect_timeout: fd: 4 tm: -1 async: 0 ldap_ndelay_on: 4 ldap_ndelay_off: 4 ldap_int_sasl_open: host=mgo-lab-openldap SASL/EXTERNAL authentication started ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({i) ber: ber_flush2: 26 bytes to sd 4 ldap_result ld 0x1306570 msgid 1 wait4msg ld 0x1306570 msgid 1 (infinite timeout) wait4msg continue ld 0x1306570 msgid 1 all 1 ** ld 0x1306570 Connections: * host: (null) port: 0 (default) refcnt: 2 status: Connected last used: Thu May 7 02:59:55 2020 ** ld 0x1306570 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x1306570 request count 1 (abandoned 0) ** ld 0x1306570 Response Queue: Empty ld 0x1306570 response count 0 ldap_chkResponseList ld 0x1306570 msgid 1 all 1 ldap_chkResponseList returns ld 0x1306570 NULL ldap_int_select read1msg: ld 0x1306570 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 40 contents: read1msg: ld 0x1306570 msgid 1 message type bind ber_scanf fmt ({eAA) ber: read1msg: ld 0x1306570 0 new referrals read1msg: mark request completed, ld 0x1306570 msgid 1 request done: ld 0x1306570 msgid 1 res_errno: 80, res_error: <SASL(0): successful result: >, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection 0 1 ldap_free_connection: refcnt 1 ldap_parse_sasl_bind_result ber_scanf fmt ({eAA) ber: ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (}) ber: ldap_msgfree ldap_err2string ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80)

2 1

Re: Remove duplicate ppolicy overlay
by Côme Chilliet 07 May '20

07 May '20

Le mercredi 6 mai 2020, 08:16:35 CEST Quanah Gibson-Mount a écrit : > You need to provide the -F option so it knows where to write the data out > to. Thank you very much, that works! -- Côme Chilliet FusionDirectory - https://www.fusiondirectory.org

1 0

Antw: [EXT] Remove duplicate ppolicy overlay
by Ulrich Windl 07 May '20

07 May '20

>>> Côme Chilliet <come.chilliet(a)fusiondirectory.org> schrieb am 06.05.2020 um 17:07 in Nachricht <19295_1588777992_5EB2D407_19295_51_1_3360663.6gdB8VmVdU@mcmic-probook>: > Hello, > > I have a duplicated ppolicy overlay. > If I try to delete it using an LDAP operation on the node under cn=config, I > get a 53 error. > > After searching I found an email on this list ( > https://www.openldap.com/lists/openldap‑technical/201811/msg00077.html ) which > suggest the following procedure: > > a) slapcat ‑n 0 ‑l /tmp/config.ldif > b) Remove the duplicate entries from /tmp/config.ldif > c) mv /path/to/current/config /path/to/current/config.old;mkdir ‑p > /path/to/current/config > d) slapadd ‑n 0 ‑l /tmp/config.ldif > > But this does not work, because when calling slapadd at the end, it > complains that there is no slapd.conf. > Is there some way to tell slapadd what to do? Did you try adding " -F confdir"? > > Or do I need to create a slapd.conf file that I remove after? > > ‑‑ > Côme Chilliet > FusionDirectory ‑ https://www.fusiondirectory.org

1 0

Remove duplicate ppolicy overlay
by Côme Chilliet 06 May '20

06 May '20

Hello, I have a duplicated ppolicy overlay. If I try to delete it using an LDAP operation on the node under cn=config, I get a 53 error. After searching I found an email on this list ( https://www.openldap.com/lists/openldap-technical/201811/msg00077.html ) which suggest the following procedure: a) slapcat -n 0 -l /tmp/config.ldif b) Remove the duplicate entries from /tmp/config.ldif c) mv /path/to/current/config /path/to/current/config.old;mkdir -p /path/to/current/config d) slapadd -n 0 -l /tmp/config.ldif But this does not work, because when calling slapadd at the end, it complains that there is no slapd.conf. Is there some way to tell slapadd what to do? Or do I need to create a slapd.conf file that I remove after? -- Côme Chilliet FusionDirectory - https://www.fusiondirectory.org

2 1

slapd not running, not producing useful messages
by Uwe Falke 06 May '20

06 May '20

Hi, I am new to openldap. I've been searching the internet and this list, but have not found a match for my issue (though there are several failures of slapd to run reported, they all appear to differ from my case in that there were some side infos provided by slapd). I've built slapd (fairly plain: --enable-bdb=no --enable-hdb=no --with-tls) , installed it and tried to start it following the instructions in the admin guide ( chapter 2. A Quick-Start Guide, for that matter). modified /usr/local/etc/openldap/slapd.ldif ran [root@...]# /usr/local/sbin/slapadd -n 0 -F /usr/local/etc/openldap/slapd.d -l /usr/local/etc/openldap/slapd.ldif _#################### 100.00% eta none elapsed none fast! Closing DB... [root@...]# chown -R slapd.slapd /usr/local/etc/openldap/ [root@...]# chown -R slapd.slapd /usr/local/var/openldap-data Then, attempting to start slapd: # /usr/local/libexec/slapd -u slapd -g slapd -F /usr/local/etc/openldap/slapd.d -VVVVV -d65535 ldap_url_parse_ext(ldap://localhost/) ldap_init: trying /usr/local/etc/openldap/ldap.conf ldap_init: using /usr/local/etc/openldap/ldap.conf ldap_init: HOME env is /root ldap_init: trying /root/ldaprc ldap_init: trying /root/.ldaprc ldap_init: trying ldaprc ldap_init: LDAPCONF env is NULL ldap_init: LDAPRC env is NULL @(#) $OpenLDAP: slapd 2.4.49 (May 4 2020 11:30:05) $ root@xcat2.meteo:/usr/local/src/openldap-2.4.49/servers/slapd Included static overlays: syncprov Included static backends: config ldif monitor mdb relay 5eb2c445 slapd stopped. 5eb2c445 connections_destroy: nothing to destroy. I've tried to strace the slapd start, but that gave me no clue ... What can I further do to get useful hints to the cause o slapd's failure to run? Why, albeit I submit -F /usr/local/etc/openldap/slapd.d, does slapd / ldap_init report "using /usr/local/etc/openldap/ldap.conf"? Mit freundlichen Grüßen / Kind regards Dr. Uwe Falke IT Specialist Global Technology Services / Project Services Delivery / High Performance Computing +49 175 575 2877 Mobile Rathausstr. 7, 09111 Chemnitz, Germany uwefalke(a)de.ibm.com IBM Services IBM Deutschland Business & Technology Services GmbH Geschäftsführung: Dr. Thomas Wolter, Sven Schooss Sitz der Gesellschaft: Ehningen Registergericht: Amtsgericht Stuttgart, HRB 17122

3 2

2.4.45 on ubuntu replication issues between peers
by Malcolm Herbert 06 May '20

06 May '20

Apologies if this is not the correct forum for this problem, however I'm having replication issues with a two-node multi-provider setup which I'm trying to diagnose and any help would be appreciated (if there is a replication troubleshooting guide available that I can follow to diagnose these issues myself, I'm more than happy to work through that, please let me know) I have the following: two ubuntu 18.04 hosts (alpha, bravo); each has 2.4.45+dfsg-1ubuntu1.4; ldaps:// is configured and visible from the other; queries by clients work fine; time is in sync between them; the memberof overlay is present and appears to work; the active configuration is in olc (cn=config) form Summary: The replication issue manifests itself this way: * ldapmodify of a user record attribute on bravo replicates ok to alpha, but the user record there loses the memberof attributes * ldapmodify of a user record attribute on alpha never replicates to bravo I can "repair" the memberof attribute for a user across both hosts by removing them from a group and then re-instating them - these ldapmodify changes must occur to bravo however Other observations are that the root node on each server seems to have different entryuuid attributes but the contextcsn from each server is present and is replicated (as shown at the bottom of this email) ... I'm also wondering whether I might have the layering of these overlays wrong - I have them in order {0}back_mdb, {1}memberof, {2}refint, {3}syncprov ... should those instead be {0}back_mdb, {1}syncprov, {2}memberof, {3}refint? Background: This setup was initially just alpha with a nis/rfc2307 schema, but I copied out all of that data, converted it to rfc2307bis, configured bravo from scratch with an rfc2307bis schema, imported my converted data and successfully migrated my clients to use bravo. Once the clients (or as many of them as I could) were looking to bravo, I dropped all the data out of alpha and then configured it from scratch to match that on bravo. Unfortunately I know I got bits of this part of the process wrong and this may have soured my result: * olcServerID was missing on both hosts * initially olcSyncrepl was explicitly excluding memberof from replication with 'exattr="memberof"' * because I couldn't get replication working, I eventually manually added the same data to alpha as I'd used to populate bravo * at some point replication *did* kind of work and my users immediately lost memberof across the board Since then, I've gradually remediated the config and data across both hosts, but replication still refuses to cooperate (as summarised above). This is the bits of the config that appear to be relevant, and as far as I can tell, they look OK to me: alpha (slightly edited for brevity) - bravo differs only in the value for olcServerID, olcRootPW hash and olcSyncrepl peer uri: dn: cn=config cn: config objectClass: olcGlobal olcArgsFile: /var/run/slapd/slapd.args olcLogLevel: none olcPidFile: /var/run/slapd/slapd.pid olcServerID: 2 olcTLSCACertificateFile: /etc/ldap/sasl2/ca-certificates.crt olcTLSCertificateFile: /etc/ldap/sasl2/server.crt olcTLSCertificateKeyFile: /etc/ldap/sasl2/server.key olcTLSVerifyClient: never olcToolThreads: 1 dn: cn=module{0},cn=config cn: module{0} objectClass: olcModuleList olcModuleLoad: {0}back_mdb olcModuleLoad: {1}memberof olcModuleLoad: {2}refint olcModuleLoad: {3}syncprov olcModulePath: /usr/lib/ldap : (omitting pages of schema definitions) : dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcAccess: {0}to attrs=userPassword by self write by anonymous auth by * none olcAccess: {1}to attrs=shadowLastChange by self write by * read olcAccess: {2}to * by * read olcAccess: {3}to * by dn.base="cn=admin,dc=domain,dc=com" read by * break olcDatabase: {1}mdb olcDbCheckpoint: 512 30 olcDbDirectory: /var/lib/ldap olcDbIndex: cn,uid eq olcDbIndex: member,memberUid eq olcDbIndex: objectClass eq olcDbIndex: uidNumber,gidNumber eq olcDbMaxSize: 1073741824 olcLastMod: TRUE olcMirrorMode: TRUE olcRootDN: cn=admin,dc=domain,dc=com olcRootPW:: yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy olcSuffix: dc=domain,dc=com olcSyncrepl: {0}rid=000 provider=ldaps://bravo.domain.com:636 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=domain,dc=com" attrs="*,+" bindmethod=simple binddn="cn=admin,dc=domain,dc=com" credentials=xxxxxxxxxxxx dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config objectClass: olcConfig objectClass: olcMemberOf objectClass: olcOverlayConfig objectClass: top olcMemberOfDangling: ignore olcMemberOfGroupOC: groupOfNames olcMemberOfMemberAD: member olcMemberOfMemberOfAD: memberOf olcMemberOfRefInt: TRUE olcOverlay: {0}memberof structuralObjectClass: olcMemberOf dn: olcOverlay={1}refint,olcDatabase={1}mdb,cn=config objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcRefintConfig objectClass: top olcOverlay: {1}refint olcRefintAttribute: memberof member manager owner structuralObjectClass: olcRefintConfig dn: olcOverlay={2}syncprov,olcDatabase={1}mdb,cn=config objectClass: olcSyncProvConfig olcOverlay: {2}syncprov olcSpCheckpoint: 100 10 structuralObjectClass: olcSyncProvConfig The root dc=domain,dc=com entry on both hosts, for comparison: # alpha dn: dc=domain,dc=com contextCSN: 20200504085236.014362Z#000000#002#000000 contextCSN: 20200504090305.772541Z#000000#001#000000 createTimestamp: 20200429092623Z creatorsName: cn=admin,dc=domain,dc=com dc: internal entryCSN: 20200429092623.624698Z#000000#000#000000 entryUUID: 3cd3ddfe-1e47-103a-9b7c-636addc89a1e modifiersName: cn=admin,dc=domain,dc=com modifyTimestamp: 20200429092623Z o: domain.com objectClass: dcObject objectClass: organization objectClass: top structuralObjectClass: organization # bravo dn: dc=domain,dc=com contextCSN: 20200504085236.014362Z#000000#002#000000 contextCSN: 20200504090303.909881Z#000000#001#000000 createTimestamp: 20200406074258Z creatorsName: cn=admin,dc=domain,dc=com dc: internal entryCSN: 20200406074258.475068Z#000000#000#000000 entryUUID: fac4ec88-0c25-103a-80b5-470686e83bfd modifiersName: cn=admin,dc=domain,dc=com modifyTimestamp: 20200406074258Z o: domain.com objectClass: dcObject objectClass: organization objectClass: top structuralObjectClass: organization Regards, Malcolm -- Malcolm Herbert mjch(a)mjch.net

2 1

Re: MDB Backend database definition
by Beker 06 May '20

06 May '20

then in this case I would like to apologize to both of you for wasting your time. I assumed dry-run could be used to test the config file before committing the changes. note: Quanah, on the file I was using there is a tab after the colon(:) instead of two spaces. Thank you and kind regards On Tue, May 5, 2020 at 4:57 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Tuesday, May 5, 2020 11:32 PM +0100 Howard Chu <hyc(a)symas.com> wrote: > > > In a dry run none of the directives are actually executed. Since the > > moduleLoad doesn't happen, the back-mdb schema isn't present. > > And on the one system where it worked would indicate that back-mdb was > compiled in vs being a shared object (just to note). > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Re: MDB Backend database definition
by Beker 05 May '20

05 May '20

I'm using the following config... Any path is adjusted according to the target OS on which is being used... for example in Freebsd openldap's modules are located in /usr/local/libexec/openldap Thanks in advance # # See slapd-config(5) for details on configuration options. # This file should NOT be world readable. # dn: cn=config objectClass: olcGlobal cn: config # # # Define global ACLs to disable default read access. # olcPidFile: /run/openldap/slapd.pid olcArgsFile: /run/openldap/slapd.args # # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #olcReferral: ldap://root.openldap.org # # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 64-bit encryption for simple bind #olcSecurity: ssf=1 update_ssf=112 simple_bind=64 # # Load dynamic backend modules: # dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/lib/openldap olcModuleload: back_mdb.la #olcModuleload: back_bdb.la #olcModuleload: back_hdb.la #olcModuleload: back_ldap.la #olcModuleload: back_passwd.la #olcModuleload: back_shell.la dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema include: file:///etc/openldap/schema/core.ldif include: file:///etc/openldap/schema/cosine.ldif include: file:///etc/openldap/schema/nis.ldif include: file:///etc/openldap/schema/inetorgperson.ldif # Frontend settings # dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: to * by * read # # Sample global access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # #olcAccess: to dn.base="" by * read #olcAccess: to dn.base="cn=Subschema" by * read #olcAccess: to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! # dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: to * by * none olcRootPW: {SSHA}pCEOC687DNCkuFE+1owDG0QRHoioRqle ####################################################################### # LMDB database definitions ####################################################################### # dn: olcDatabase=mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: mdb olcDbMaxSize: 1073741824 olcSuffix: dc=hlab,dc=lan olcRootDN: cn=hlabadm,dc=hlab,dc=lan # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd-config(5) for details. # Use of strong authentication encouraged. olcRootPW: {SSHA}dZlyVv5cR432HIzRmnbTq3O6TNOVM6rx # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. olcDbDirectory: /var/lib/openldap/openldap-data # Indices to maintain olcDbIndex: objectClass eq On Tue, May 5, 2020 at 11:16 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Tuesday, May 5, 2020 12:02 PM -0500 Beker <fzfq3m(a)gmail.com> wrote: > > > Yep, that was an error I made when I redacted the email and changed the > > the rootdn to not leak info about my environment (which might be stupid > > since this is just a home lab) > > I would suggest you provide the full, unredacted slapd.ldif file you were > loading. > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

3 3

OpenLDAP, systemd and EL 7.7
by Abdelkader Chelouah 05 May '20

05 May '20

Hello, Since the upgrade to RHEL 7.7, my openldap service with property |Type=forking| and property |PIDFile| defined doesn't start and its status shows the following error messages: May 02 20:02:57 systemd[1]: New main PID 445254 does not belong to service, and PID file is not owned by root. Refusing. Actually, slapd is started with -u ldap -g ldap options, so the owner of the pid file slapd.pid is ldap. The problem was introduced by |systemd-219-67| to fix the security issue CVE-2018-16888. See https://access.redhat.com/solutions/4420581 for more details. Is there a way to overcome this issue ? Regards

3 3

MDB Backend database definition
by Beker 05 May '20

05 May '20

Hello I'm getting an error while trying to use MDB backend. The section that's giving issue is the following one: ####################################################################### # LMDB database definitions ####################################################################### # dn: olcDatabase=mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: mdb olcDbMaxSize: 1073741824 olcSuffix: dc=test,dc=local olcRootDN: cn=mdbadm,test,dc=local # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd-config(5) for details. # Use of strong authentication encouraged. olcRootPW: {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. olcDbDirectory: /var/db/openldap-data # Indices to maintain olcDbIndex: objectClass eq with this section added to the end of slapd.ldif i get the error *5ea9641d <= str2entry: str2ad(olcDbMaxSize): attribute type undefined* while testing the import using *slapadd -v -n0 -F /etc/openldap/slapd.d -l /etc/openldap/slapd.ldif* if i comment the offending line *olcDbMaxSize: 1073741824* then I just get an error with another line in the same section. This is a fresh install, the slapd.d folder is empty and I'm using the example slapd.ldif.sample that comes with the software (it has mdb lodaded as module by default) # # Load dynamic backend modules: # dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/lib/openldap #olcModuleload: back_bdb.so #olcModuleload: back_hdb.so #olcModuleload: back_ldap.so olcModuleload: back_mdb.so #olcModuleload: back_passwd.so #olcModuleload: back_shell.so Thanks in dvance for any hint or help you can provide Best regards

3 3

OpenLDAP help - Import issue
by Pranjit Biswas 05 May '20

05 May '20

HI , We are trying to install openldap.x86_64 - 2.4.44-21.el7_6 on an Linux RHEL 7.7 on AWS . We have installed and made changes to the config files and did a slaptest of the config file as shown below . [root@efg-ac cn=config]# slaptest -u 5ea6064f ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={0}config.ldif" 5ea6064f ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif" config file testing succeeded Now we are importing the ldif file from our current on-prem server . Even though we were getting different errors earlier , after all the changes we have made to the config , the error that we are getting now is ldap_bind error for the credentials . [root@efg-dev cn=config]# ldapadd -w xxxxxxxx -x -D "cn=Manager,dc=bpost,dc=be" -f ldap_dump-27042020-DEV.ldif ldap_bind: Invalid credentials (49) We are not sure which password to give here . We have given the same credentials in the config file : olcDatabase={2}hdb.ldif olcRootDN: cn=Manager,dc=bpost,dc=be olcRootPW: xxxxxxxx Regards, Pranjit | Lead Consultant |B2B Cell:- +91-9573080955 pranjit_biswas(a)infosys.com<mailto:pranjit_biswas@infosys.com> PTO Plan :- None

3 6

Can not find object by attribute value
by xaled＠web.de 05 May '20

05 May '20

Hi, Could someone help me with this one? I have a user1 with inetUserStatus: active and user2 inetUserStatus: inactive. If I search for a user with a inetUserStatus=(in)active I don't get any results: # ldapsearch -x -H ldap://127.0.0.1:389 -D 'cn=admin,dc=gal,dc=example,dc=com' -w secret -LLL -b ou=people,dc=gal,dc=example,dc=com '(inetUserStatus=active)' # ldapsearch -x -H ldap://127.0.0.1:389 -D 'cn=admin,dc=gal,dc=example,dc=com' -w secret -LLL -b ou=people,dc=gal,dc=example,dc=com '(inetUserStatus=inactive)' What is wrong with my search or slapd config? If I search for a * as attribute value I get both users. # ldapsearch -x -H ldap://127.0.0.1:389 -D 'cn=admin,dc=gal,dc=example,dc=com' -w secret -LLL -b ou=people,dc=gal,dc=example,dc=com '(inetUserStatus=*)' dn: uid=user2,ou=people,dc=gal,dc=example,dc=com shadowWarning: 0 gidNumber: 100 shadowMax: 0 objectClass: top objectClass: account objectClass: posixAccount objectClass: shadowAccount objectClass: inetUser loginShell: /bin/bash userPassword:: e1NTSEF9TVk0WW432UzRxYjRBNWN1TFlTaXZCVFBHRFN3MzdoYWs= uid: user2 shadowLastChange: 0 cn: user2 homeDirectory: /home/user2 uidNumber: 1006 gecos: user2 inetUserStatus: inactive dn: uid=user1,ou=people,dc=gal,dc=example,dc=com objectClass: top objectClass: account objectClass: posixAccount objectClass: shadowAccount objectClass: inetUser cn: user1 uid: user1 uidNumber: 1005 gidNumber: 100 homeDirectory: /home/user1 loginShell: /bin/bash userPassword:: e1NTSEF9TVk0WW1HU231xYjRBNWN1TFlTaXZCVFBHRFN3MzdoYWs= shadowLastChange: 0 shadowMax: 0 shadowWarning: 0 inetUserStatus: active gecos: user1 # ldapsearch -LLLQY EXTERNAL -H ldapi:/// -b cn=schema,cn=config dn dn: cn=schema,cn=config dn: cn={0}core,cn=schema,cn=config dn: cn={1}cosine,cn=schema,cn=config dn: cn={2}nis,cn=schema,cn=config dn: cn={3}inetorgperson,cn=schema,cn=config dn: cn={4}ldapab,cn=schema,cn=config dn: cn={5}openxchange,cn=schema,cn=config dn: cn={6}evolutionperson,cn=schema,cn=config dn: cn={7}inetUser,cn=schema,cn=config s# ldapsearch -LLLQY EXTERNAL -H ldapi:/// -o ldif-wrap=no -b cn={7}inetUser,cn=schema,cn=config dn: cn={7}inetUser,cn=schema,cn=config objectClass: olcSchemaConfig cn: {7}inetUser olcAttributeTypes: {0}( 1.2.840.113556.1.2.102 NAME 'memberOf' DESC 'Group that the entry belongs to' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'Netscape Delegated Administrator' ) olcAttributeTypes: {1}( 2.16.840.1.113730.3.1.692 NAME 'inetUserStatus' DESC '"active", "inactive", or "deleted" status of a user' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape subscriber interoperability' ) olcAttributeTypes: {2}( 2.16.840.1.113730.3.1.693 NAME 'inetUserHttpURL' DESC 'A users Web addresses' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Netscape subscriber interoperability' ) olcObjectClasses: {0}( 2.16.840.1.113730.3.2.130 NAME 'inetUser' DESC 'Auxiliary class which must be present in an entry for delivery of subscriber services' SUP top AUXILIARY MAY ( uid $ inetUserStatus $ inetUserHTTPURL $ userPassword $ memberOf ) X-ORIGIN 'Netscape subscriber interoperability' ) Thanks

2 2

Antw: [EXT] Can not find object by attribute value
by Ulrich Windl 05 May '20

05 May '20

>>> <xaled(a)web.de> schrieb am 04.05.2020 um 23:10 in Nachricht <3418_1588627588_5EB08884_3418_88_1_1c5701d62258$69c28330$3d478990$(a)web.de>: > Hi, > > > > Could someone help me with this one? I have a user1 with inetUserStatus: > active and user2 inetUserStatus: inactive. If I search for a user with a > inetUserStatus=(in)active I don't get any results: > > > > # ldapsearch ‑x ‑H ldap://127.0.0.1:389 ‑D > 'cn=admin,dc=gal,dc=example,dc=com' ‑w secret ‑LLL ‑b > ou=people,dc=gal,dc=example,dc=com '(inetUserStatus=active)' > > # ldapsearch ‑x ‑H ldap://127.0.0.1:389 ‑D > 'cn=admin,dc=gal,dc=example,dc=com' ‑w secret ‑LLL ‑b > ou=people,dc=gal,dc=example,dc=com '(inetUserStatus=inactive)' > > > > What is wrong with my search or slapd config? > > > > If I search for a * as attribute value I get both users. > > > > # ldapsearch ‑x ‑H ldap://127.0.0.1:389 ‑D > 'cn=admin,dc=gal,dc=example,dc=com' ‑w secret ‑LLL ‑b > ou=people,dc=gal,dc=example,dc=com '(inetUserStatus=*)' > > dn: uid=user2,ou=people,dc=gal,dc=example,dc=com > > shadowWarning: 0 > > gidNumber: 100 > > shadowMax: 0 > > objectClass: top > > objectClass: account > > objectClass: posixAccount > > objectClass: shadowAccount > > objectClass: inetUser > > loginShell: /bin/bash > > userPassword:: e1NTSEF9TVk0WW432UzRxYjRBNWN1TFlTaXZCVFBHRFN3MzdoYWs= > > uid: user2 > > shadowLastChange: 0 > > cn: user2 > > homeDirectory: /home/user2 > > uidNumber: 1006 > > gecos: user2 > > inetUserStatus: inactive > > > > dn: uid=user1,ou=people,dc=gal,dc=example,dc=com > > objectClass: top > > objectClass: account > > objectClass: posixAccount > > objectClass: shadowAccount > > objectClass: inetUser > > cn: user1 > > uid: user1 > > uidNumber: 1005 > > gidNumber: 100 > > homeDirectory: /home/user1 > > loginShell: /bin/bash > > userPassword:: e1NTSEF9TVk0WW1HU231xYjRBNWN1TFlTaXZCVFBHRFN3MzdoYWs= > > shadowLastChange: 0 > > shadowMax: 0 > > shadowWarning: 0 > > inetUserStatus: active > > gecos: user1 > > > > # ldapsearch ‑LLLQY EXTERNAL ‑H ldapi:/// ‑b cn=schema,cn=config dn > > dn: cn=schema,cn=config > > dn: cn={0}core,cn=schema,cn=config > > dn: cn={1}cosine,cn=schema,cn=config > > dn: cn={2}nis,cn=schema,cn=config > > dn: cn={3}inetorgperson,cn=schema,cn=config > > dn: cn={4}ldapab,cn=schema,cn=config > > dn: cn={5}openxchange,cn=schema,cn=config > > dn: cn={6}evolutionperson,cn=schema,cn=config > > dn: cn={7}inetUser,cn=schema,cn=config > > > > s# ldapsearch ‑LLLQY EXTERNAL ‑H ldapi:/// ‑o ldif‑wrap=no ‑b > cn={7}inetUser,cn=schema,cn=config > > dn: cn={7}inetUser,cn=schema,cn=config > > objectClass: olcSchemaConfig > > cn: {7}inetUser > > olcAttributeTypes: {0}( 1.2.840.113556.1.2.102 NAME 'memberOf' DESC 'Group > that the entry belongs to' EQUALITY distinguishedNameMatch SYNTAX > 1.3.6.1.4.1.1466.115.121.1.12 X‑ORIGIN 'Netscape Delegated Administrator' ) > > olcAttributeTypes: {1}( 2.16.840.1.113730.3.1.692 NAME 'inetUserStatus' DESC > '"active", "inactive", or "deleted" status of a user' SYNTAX > 1.3.6.1.4.1.1466.115.121.1.15 SINGLE‑VALUE X‑ORIGIN 'Netscape subscriber > interoperability' ) There's no EQUALITY. Does slapd log any message when you try to compare? > > olcAttributeTypes: {2}( 2.16.840.1.113730.3.1.693 NAME 'inetUserHttpURL' > DESC 'A users Web addresses' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X‑ORIGIN > 'Netscape subscriber interoperability' ) > > olcObjectClasses: {0}( 2.16.840.1.113730.3.2.130 NAME 'inetUser' DESC > 'Auxiliary class which must be present in an entry for delivery of > subscriber services' SUP top AUXILIARY MAY ( uid $ inetUserStatus $ > inetUserHTTPURL $ userPassword $ memberOf ) X‑ORIGIN 'Netscape subscriber > interoperability' ) > > > > Thanks

2 1

Antw: [EXT] RE: OpenLDAP help - Import issue
by Ulrich Windl 04 May '20

04 May '20

>>> Quanah Gibson-Mount <quanah(a)symas.com> schrieb am 04.05.2020 um 19:27 in Nachricht <31908_1588613249_5EB05081_31908_246_1_24A29F72442AE6729B2A09EC(a)[192.168.1.144]> > > ‑‑On Monday, May 4, 2020 10:51 AM +0000 Pranjit Biswas > <Pranjit_Biswas(a)infosys.com> wrote: > > >> This SSHA PW has been updated in olcDatabase={2}hdb.ldif. >> >> olcRootPW: {SSHA}wbMAL > > Each file in the cn=config DATABASE has this line at the start: > > # AUTO‑GENERATED FILE ‑ DO NOT EDIT!! Use ldapmodify. > > You may wish to read that line and understand what it's telling you. Maybe "Use ldapmodify." could be a bit more verbose ;-) > > Regards, > Quanah > > ‑‑ > > Quanah Gibson‑Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com>

1 0

Antw: [EXT] OpenLDAP, systemd and EL 7.7
by Ulrich Windl 04 May '20

04 May '20

>>> Abdelkader Chelouah <a.chelouah(a)gmail.com> schrieb am 02.05.2020 um 23:26 in Nachricht <30537_1588524939_5EAEF789_30537_298_1_913c1269-d74f-9b81-9715-9d956d39f12a@gmai .com>: > Hello, > > > Since the upgrade to RHEL 7.7, my openldap service with property > |Type=forking| and property |PIDFile| defined doesn't start and its > status shows the following error messages: > > > May 02 20:02:57 systemd[1]: New main PID 445254 does not belong to > service, and PID file is not owned by root. Refusing. Is it due to the fact that PIDs are larger than they used to be? > > > Actually, slapd is started with -u ldap -g ldap options, so the owner of > the pid file slapd.pid is ldap. The problem was introduced by > |systemd-219-67| to fix the security issue CVE-2018-16888. See > https://access.redhat.com/solutions/4420581 for more details. > > > Is there a way to overcome this issue ? > > > Regards

1 0

LTB packages for OpenLDAP 2.4.50 (was: OpenLDAP 2.4.50 available)
by Clément OUDOT 03 May '20

03 May '20

Hello, LDAP Tool Box packages for OpenLDAP 2.4.50 are available for RedHat/CentOS/Debian/Ubuntu : https://ltb-project.org/download#openldap Thanks to David Coutadeur for the Debian packages. Clément.

1 0

LDAP performance
by Technology Server 30 Apr '20

30 Apr '20

Dears, How to get a response time curve showing how fast queries are answered by each instance of LDAP ? How can we measure LDAP performance based on all possible aspects ? Regards, Tech Sever.

3 2

2.4.50 and pw-argon2
by Michael Ströder 29 Apr '20

29 Apr '20

HI! Anything special with installing the man-page of pw-argon2? It fails in openSUSE Build Service: [ 112s] mkdir -p `grep -e "^prefix =" ../../../../Makefile | cut -d= -f2`/share/man/man5 [ 112s] /usr/bin/install -m 644 slapd-pw-argon2.5 `grep -e "^prefix =" ../../../../Makefile | cut -d= -f2`/share/man/man5 [ 112s] /usr/bin/install: cannot create regular file '/usr/share/man/man5/slapd-pw-argon2.5': Permission denied [ 112s] make: *** [Makefile:70: install-man] Error 1 [ 112s] make: *** Waiting for unfinished jobs.... Ciao, Michael.

4 6

-DLDAP_USE_NON_BLOCKING_TLS (was: OpenLDAP 2.4.50 available)
by Michael Ströder 29 Apr '20

29 Apr '20

On 4/28/20 7:16 PM, project(a)openldap.org wrote: > OpenLDAP 2.4.50 is now available for download as detailed on our download page: Building with -DLDAP_USE_NON_BLOCKING_TLS now fails. It worked with 2.4.49. Ciao, Michael. --------------------------------------------- cc -g -O0 -DNDEBUG -DSLAP_SCHEMA_EXPOSE -DLDAP_COLLECTIVE_ATTRIBUTES -DSLAP_CONFIG_DELETE -DLDAP_USE_NON_BLOCKING_TLS -Wl,-R/usr/lib -Wl,-R/usr/lib -Wl,-R/usr/lib -Wl,-R/usr/lib -o .libs/apitest apitest.o -L/usr/lib ./.libs/libldap.so /home/michael/src/openldap-git/re24/openldap/libraries/liblber/.libs/liblber.so ../../libraries/liblber/.libs/liblber.so ../../libraries/liblutil/liblutil.a -lsasl2 -lssl -lcrypto -lcrypt -lresolv -Wl,--rpath -Wl,/opt/openldap-re24/lib64 /usr/lib64/gcc/x86_64-suse-linux/9/../../../../x86_64-suse-linux/bin/ld: ./.libs/libldap.so: undefined reference to `Debug1' /usr/lib64/gcc/x86_64-suse-linux/9/../../../../x86_64-suse-linux/bin/ld: ./.libs/libldap.so: undefined reference to `Debug3' collect2: error: ld returned 1 exit status make[2]: *** [Makefile:309: apitest] Error 1 make[2]: Leaving directory '/home/michael/src/openldap-git/re24/openldap/libraries/libldap' make[1]: *** [Makefile:296: all-common] Error 1 make[1]: Leaving directory '/home/michael/src/openldap-git/re24/openldap/libraries' make: *** [Makefile:312: all-common] Error 1

2 1

Can't delete olcAccess entries
by Gao 28 Apr '20

28 Apr '20

Hello, I am using OpenLDAP 2.4.40 on CentOS 7.6. I tried to remove 2 ACL entries and failed. I must missed something so please help me. I now have: dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=van,dc=company,dc=com olcRootDN: cn=Manager,dc=van,dc=company,dc=com olcRootPW:: e1NTSEF9cEpWbEIzOEh4UXJpcjNVSUl2enZz0sm1akt4Nnd6OTk= olcDbIndex: objectClass eq,pres olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: loginShell eq olcDbIndex: uid eq,pres,sub olcDbIndex: memberUid eq,pres,sub olcDbIndex: uniqueMember eq,pres olcDbIndex: sambaSID eq olcDbIndex: sambaPrimaryGroupSID eq olcDbIndex: sambaGroupType eq olcDbIndex: sambaSIDList eq olcDbIndex: sambaDomainName eq olcDbIndex: default sub structuralObjectClass: olcHdbConfig entryUUID: 3b7e5722-d26f-1035-8835-91213c5bb357 creatorsName: cn=config createTimestamp: 20160629180122Z olcAccess: {0}to attrs=userPassword by self write by anonymous auth by dn.ba se="cn=Manager,dc=van,dc=company,dc=com" write by * none olcAccess: {1}to * by self write by dn="cn=Manager,dc=van,dc=company,dc= com" write by * read entryCSN: 20200427230612.038641Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20200427230612Z Then I created a LDIF file: # cat delete_acl.ldif dn: olcDatabase={2}hdb,cn=config changetype: modify delete: olcAccess olcAccess: {0} olcAccess: {1} Now try to delete the ACL: # ldapmodify -Y EXTERNAL -H ldapi:/// -f delete_acl.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={2}hdb,cn=config" # When I check with "slapcat -n 0" I see the 2 olcAssess entires is still exist. Please help. Thanks. Gao

3 3

dn with space space in olcRefintNothing
by Sébastien Chaumat 24 Apr '20

24 Apr '20

Hello, When configuring refint on slapd 2.4.49 the following is accepted : dn: olcOverlay={2}refint,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcRefintConfig olcOverlay: {2}refint olcRefintAttribute: seeAlso olcRefintNothing: cn=admin,dc=test but olcRefintNothing: cn=admin space,dc=test is rejected when I ldapadd the configuration with the message : ldap_add: Constraint violation (19) additional info: <olcRefintNothing> extra cruft after <string> I tried various quoting : cn="admin space",dc=test cn=admin\20space "cn=admin space" Do I miss something ? THX Sébastien

2 1

Re: Openldap Master-Slave setup
by Quanah Gibson-Mount 24 Apr '20

24 Apr '20

--On Thursday, April 23, 2020 9:41 PM -0700 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > olcDatabase={2}bdb,cn=config: BDB is deprecated. I'd advise using a non-deprecated backend. > olcReadOnly: TRUE > olcSyncrepl: {0}rid=001 provider=ldap://10.126.0.21:10389/ > binddn="cn=manager,dc=example,dc=com" bindmethod=simple > credentials=TopSecret searchbase="dc=example,dc=com" attrs="*,+" > type=refreshAndPersist retry="60 1 300 12 7200 +" timeout=1 > olcUpdateRef: ldap://10.126.0.21:10389 > olcMirrorMode: TRUE Is it a consumer or a multimaster node? You have enabled multiprovider (which is horribly misnamed as "mirrormode", and really just means you're defining it as part of a multiprovider cluster). > Chain overlay on frontendDB: > > > dn: olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config > objectClass: olcOverlayConfig > objectClass: olcChainConfig > olcOverlay: {0}chain > olcChainReturnError: TRUE > > dn: > olcDatabase={0}ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config > objectClass: olcLDAPConfig > objectClass: olcChainDatabase > olcDatabase: {0}ldap > olcDbURI: ldap://10.126.0.21:10389/ > olcDbIDAssertBind: bindmethod=simple > binddn="cn=manager,dc=example,dc=com" credentials=TopSecret mode=self > olcDbRebindAsUser: TRUE Why would chaning on the frontend database affect the ability of your dc=example,dc=com database to forward updates? You've clearly misconfigured your system. > So with the above config, if i add entry in master it is replicating to > slave but when i try to add entry in slave its not allowing write as > expected but its not forwarding request to referral ( its because of > ldapadd doesnt follow referral) is it expected? How do i make sure if > updatereferral is working properly? Configure your system correctly? You may also want to examine test032 in the test suite which specifically configures this. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Specific outgoing IP for syncrepl
by Dale Thompson - NOAA Federal 24 Apr '20

24 Apr '20

I've been using openldap's multi-master syncrepl based sync for years and it works great. But, I would like to be able to specify which IP on a multi-IP system syncrepl makes outgoing connections to other members of the sync cluster. On my multi-IP servers I am able to get slapd to only bind to a specific IP with the appropriate -h option. That works fine. But, outgoing syncrepl connections come from the primary IP on the server. Can anyone suggest a way to specify which IP syncrepl will use to make outgoing replication queries? -- Dale James Thompson, NWS Radar Operations Center IT Specialist, Configuration Management Team 1313 Halley Circle Norman, OK 73069 Voice (405) 573-3472 Fax (405) 573-3480 Dale.J.Thompson(a)noaa.gov

3 3

Re: Openldap Master-Slave setup
by Quanah Gibson-Mount 23 Apr '20

23 Apr '20

--On Thursday, April 23, 2020 10:45 AM -0700 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > > Quanah, > > > Thanks for quick response, with the above configuration does ldapadd on > slave through referral error message? We configured referral in slave > but when we did ldapadd its not throwing referral error but just > accepting the request, is it expected? i read in some other post where > user get below error in case of referral configured. I don't know what you were reading or if it's even related to OpenLDAP. As I said, it's up to clients to follow referrals if one is returned. The ldap* clients do not follow referrals. If you want the consumer to forward updates to the provider on the writer's behalf, then you need to configure chaining as I already stated. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Openldap Master-Slave setup
by Quanah Gibson-Mount 23 Apr '20

23 Apr '20

--On Thursday, April 23, 2020 9:11 AM -0700 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > Any idea? If this is not the right way to do, can you please point me to > a correct procedure? It is on clients to follow referrals if they are returned. If you want the consumer to forward the updates to the provider, then you need to configure chaining. man slapo-chain(5). Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: argon2, available as of what release?
by bitsof info 21 Apr '20

21 Apr '20

awesome, when might that be out? On Tue, Apr 21, 2020 at 1:34 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Tuesday, April 21, 2020 1:28 PM -0700 Quanah Gibson-Mount > <quanah(a)symas.com> wrote: > > > It will be a part of the 2.5 release series. However, I believe Ryan has > > backported it to 2.4 for the Debian builds. > > I just discussed with Howard, we'll be adding it to the 2.4.50 release. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

argon2, available as of what release?
by bitsof info 21 Apr '20

21 Apr '20

Hi, Trying to follow as of what OpenLdap release is the argon2 support made available? Looking here it looks like it was originally committed 3 years ago w/ recent updates 5 months ago: https://git.openldap.org/openldap/openldap/-/commits/af5ed7c6e27d596dbed440… But here in releases I don't see it mentioned: https://www.openldap.org/software/release/changes.html What minimum version of OpenLdap should I be running to have the argon2 support w/ the latest commit mentioned here? https://git.openldap.org/openldap/openldap/-/commit/af5ed7c6e27d596dbed440c… >= 2.4.45 for argon2 support? >= 2.4.49 for argon2 support w/ libsodium changes? also anyone know of a centos 7 package w/ all these pw contrib (argon2) module already built in it? thanks

2 2

RE: [External] RE: Problem using ldapsearch across forests with trust
by Quanah Gibson-Mount 17 Apr '20

17 Apr '20

--On Thursday, April 16, 2020 11:37 PM +0000 "Kleber S. Carvalho" <kleber.s.carvalho(a)avanade.com> wrote: > Hello, Quanah! > > I really appreciate your engagement in this case. > > Please help me understand if the client can validate the AD scenario with > the ldapsearch tool or not, or if ldapsearch is not supported in the > forest. You might need to see what options the Java program is using. For example, is it following referrals? Again, AD is not LDAP and so what you're talking about is really not LDAP related. There are no "forests" in LDAP, etc. Please stop CCing bugs(a)openldap.org Please don't send attachments to openldap-technical (your emails get dropped if you do). --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

RE: Problem using ldapsearch across forests with trust
by Quanah Gibson-Mount 16 Apr '20

16 Apr '20

--On Thursday, April 16, 2020 2:10 PM +0000 "Kleber S. Carvalho" <kleber.s.carvalho(a)avanade.com> wrote: > First, we performed a valid test by performing authentication and a > simple query directly to the minca.com domain, with the command: > > ldapsearch -H 'LDAP: //minca.com: 3268' -D 'cn = Administrator, cn = > users, dc = minca, dc = with' -w Avanade @ 2020! -b 'cn = users, dc = > minca, dc = com' > > However, when performing this procedure and authenticating the user > minca(a)minca.com in the child.klabs.com domain using the ldapsearch tool, > the result was an error according to file > 7_openldaperror_indirectaccess.JPG stating invalid credentials. Expected I would think, if using a simple bind. > However, a .net application was created to perform this same function and > it worked, as per file 9_dotNetApp_success.JPG. AD is not LDAP. > Finally, the conclusion we are reaching is that the openldap tool does > not work directly between forests, but only on the same tree. We would > like to know if this understanding is correct or if this is really a bug > in the tool. AD is not LDAP. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

rootdn & password policy
by Hannah Chenh 15 Apr '20

15 Apr '20

Hello, I have a question related to rootdn and password policy. I understand that the rootdn can bypass all restrictions. We have a requirement to bypass a password policy for the admin user. Is there a way to create the admin user so that this user can have the same privilege as rootdn and I don't need to bind as rootdn in my application? Currently I have granted the following to the admin_user: === dn: olcDatabase={2}hdb,cn=config changetype: modify add: olcAccess olcAccess: {0}to attrs=userPassword by self write by anonymous auth by dn.base="cn=Manager,dc=abcdomain,dc=com" write by dn.base="uid=admin_user,ou=Service Accounts,dc=abcdomain,dc=com" write by * none olcAccess: {1}to * by self write by dn.base="cn=Manager,dc=abcdomain,dc=com" write by dn.base="uid=admin_user,ou=Service Accounts,dc=abcdomain,dc=com" write by * read === Any help would be appreciated. Thanks, Hannah

5 7

Class-of-service type of feature in OpenLDAP?
by Nick Folino 15 Apr '20

15 Apr '20

I'm moving from ODSEE to OpenLDAP and need to replace our current method of assigning password policies. We're using class-of-service. Is there any way to replicate this in OpenLDAP? Basically I want to assign a virtual attribute (pwdpolicysubentry) based on the value of another attribute (objectclass). For example users with objectclass: x would have pwdpolicysubentry:x and users with objectclass: y would have pwdpolicysubentry:y Thanks, Nick

1 0

Re: [EXT] Re: Clarification of LMDB transaction behaviour
by Ulrich Windl 15 Apr '20

15 Apr '20

On 4/9/20 7:33 PM, Howard Chu wrote: [...] > Tracking the existence of transactions in a language binding is almost certainly a wrong thing > to do, completely unnecessary. MHO: Actually as you must either abort or commit any transaction, any long-running application would need to keep track of active transactions. Complex control flows may need such. How does LMDB react if you try to abort a committed transaction, or trying to commit an aborted transaction (the other two cases should be idempontent, hopefully)? Such tings could happen easily if the application does not track the state of active transactions. >> >> Thanks in advance, >> >> -- >> Dorian Taylor >> Make things. Make sense. >> https://doriantaylor.com >> > >

2 1

Re: Read only Replica
by Marc Franquesa 12 Apr '20

12 Apr '20

What I like most of this list is that I always learnt (or remember) something in few posts. About the ServerID>0: Sure, didn't realized that and makes total sense, as ServerID is used to generate CSN changes, so if ServerID=0 then is not writting CSNs -> not a provider. About my setup and needs: At the end I'm going to deploy a N-way multimaster, but while testing just wanted to ensure no "accidental" writes reach the new 'tested' member. You solved perfectly all my concerns Thanks much Missatge de Quanah Gibson-Mount <quanah(a)symas.com> del dia dj., 9 d’abr. 2020 a les 17:31: > > > --On Thursday, April 9, 2020 6:19 PM +0200 Michael Ströder > <michael(a)stroeder.com> wrote: > >> a) syncprov (and possibly accesslog), no serverID >1, and no syncrepl > >> statement, it is a standalone provider > > > > should be: serverID > 0 <=> serverID >= 1 > > > >> b) syncprov (and possibly accesslog), serverID > 1, and a syncrepl > >> statement, it is a multimaster node > > > > should be: serverID > 0 <=> serverID >= 1 > > Correct, thanks. :) > > > Isn't mirrormode true not also needed for MMR? > > Ah right, thanks. :) > > >> I'm not really clear what you mean by "read only" in any of these cases. > >> If you want an LDAP server that accepts no writes at all, then you > >> shouldn't configure replication, as any writes that occur on the > >> provider will then occur on the consumer, and additionally set the > >> readonly configuration parameter to TRUE. > > > > He probably wants to implement a 2-tier replication topology where > > applications/systems access pure consumer replicas which do not accept > > write operations from normal clients but only the modifications > > retrieved via syncrepl from providers. > > (At least that's how Æ-DIR is designed. ;-) > > Yeah, that's my guess too, but their statements make that hard to > determine. ;) > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Clarification of LMDB transaction behaviour
by Dorian Taylor (Lists) 10 Apr '20

10 Apr '20

Re-re-sending this because it appears twice not to have initially made it through: I have recently taken up stewardship of the Ruby binding for LMDB. It did not take me long to find problems in its design pertaining to concurrent transactions in a multithreaded environment. I would like to fix these problems but I am afraid I still have a few questions after carefully reading the LMDB documentation. First, I would like to confirm my understanding that there may be only one active read-write transaction per environment, irrespective of processes and/or threads attached, although this transaction may be nested. This raises some subsidiary questions: 1) The documentation states specifically that *read-write* transactions may be nested, but what about read-only? 2) Must (read-only) transactions always be in a single hierarchy per thread or can there be many “roots” at once? 3) Given that the relevant LMDB structs appear not to discriminate between transaction types, are there consequences for opening, e.g., a read-write transaction subordinate to a read-only one? The reason why I ask is that the current (inherited) design of the binding keeps a hash table of transactions keyed by thread, and does not distinguish between read-write and read-only, and affords only a single “root” transaction per thread (whether read-write or read-only). I don’t need the memory leaks, double-frees, deadlocks and other bad behaviour to infer that this structure is probably wrong. Based on what I can glean from the LMDB documentation, is that I probably want to separate the read-write and read-only transactions, make the former a singleton (since there can only be one read-write transaction per environment), artificially flatten the latter (since it probably isn’t meaningful to nest a read-only transaction anyway) and then wrap the transaction code so it does the right thing. What I suppose I’m looking for here is confirmation that my assumptions are correct. Thanks in advance, -- Dorian Taylor Make things. Make sense. https://doriantaylor.com

3 5

Read only Replica
by Marc Franquesa 09 Apr '20

09 Apr '20

I wrongly supposed that a LDAP server configured with replication (sycnrepl) and not using syncprov modules (so is only a consumer and not a provider) would automatically behave as a Read-ONLY replica as it will sync from other servers specified on the syncrepl settings but will not be providing deltas thru syncprov module. However I tested the following scenario (N-way multimatseer with one 'Readreplica') - Servers A and B with syncprov enabled (so they are providers) - Servers A and B both sync (syncprel) to the other (so they are consumers) - Added server C syncrepl to A and B, *BUT not loading syncprov*. So is a consumer only, (ReadReplica)? However I verified that I can make changes to C and they got stored into C. (Not replicated to A/B as they don't sync with C). - So how I got C behave like a true ReadOnly replica (denying writes)? - If I have to set some settings, note that I'm also replicating olcConfig tree cn=config, so how I got this setting applied only to one server? Thanks for any hints or explation on my doubts.

4 5

Can syncrepl do both database and acl?
by xuhua.lin＠gmail.com 08 Apr '20

08 Apr '20

In a simple provider-consumer setup, I added syncprov to both config (config, cn=config) and the database (mdb,cn=config) on the provider, added syncrepl respectively on the consumer. The initial replication seems working, entries added to provider will show up at consumer until an acl rule added into provider. When I check the consumer, the syncrepl directive in the (mdb, cn=config) is removed. I guess it's trying to replicate producer's config since there is no syncrel on the provider (I also see syncprov added to consumer). This defeats the purpose of database replication. Is this expected behavior? Did I miss anything? (In master-master setup, every server is replicating everything for each other.) Thanks, Xuhua

3 2

Re: [EXT] Slapd unexpectedly shutdown
by Kevin Olbrich 08 Apr '20

08 Apr '20

Am Di., 7. Apr. 2020 um 23:18 Uhr schrieb Quanah Gibson-Mount <quanah(a)symas.com>: > > > > --On Tuesday, April 7, 2020 11:36 PM +0200 Kevin Olbrich <ko(a)sv01.de> wrote: > > > Def. ANOM_ABEND: Triggered when a processes ends abnormally (with a > > signal that could cause a core dump, if enabled). > > > > Looks like it's actually crashing but I don't think it's because of > > "slap_global_control: unrecognized control: 1.3.6.1.4.1.42.2.27.8.5.1" > > as I can see multiple lines before the crash. > > > > Is it possible that Slapd crashed if it tries to proxy data to a node > > while it shuts down? Maybe a special case when bind was successful but > > query failes? > > Hi Kevin, > > What OpenLDAP Release are you running? I ask, because there was a fix that > went into OpenLDAP 2.4.49 specifically for a crasher with back-ldap and > controls: > > <https://bugs.openldap.org/show_bug.cgi?id=9076> > > Regards, > Quanah > My version is 2.4.49+dfsg-2~bpo10+1 (buster-backports). Should be in there I think. I've now included ppolicy.schema to solve the issue. Tomorrow I will try if the issue is still present. Thanks for your input! Regards Kevin > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com>

3 3

Re: [EXT] Slapd unexpectedly shutdown
by Quanah Gibson-Mount 07 Apr '20

07 Apr '20

--On Tuesday, April 7, 2020 11:36 PM +0200 Kevin Olbrich <ko(a)sv01.de> wrote: > Def. ANOM_ABEND: Triggered when a processes ends abnormally (with a > signal that could cause a core dump, if enabled). > > Looks like it's actually crashing but I don't think it's because of > "slap_global_control: unrecognized control: 1.3.6.1.4.1.42.2.27.8.5.1" > as I can see multiple lines before the crash. > > Is it possible that Slapd crashed if it tries to proxy data to a node > while it shuts down? Maybe a special case when bind was successful but > query failes? Hi Kevin, What OpenLDAP Release are you running? I ask, because there was a fix that went into OpenLDAP 2.4.49 specifically for a crasher with back-ldap and controls: <https://bugs.openldap.org/show_bug.cgi?id=9076> Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

macbookair configuration to connect to network personal folder
by Arnaud Gymnase 07 Apr '20

07 Apr '20

Hello all, I've a procect for a school to authenticate macbooks to an OpenLDAP Server. The server part has been build using a ClearOS system (centos) with OpenLDAP. I then configured the macbook to authentify to my OpenLDAP server to open a session and this works fine. The next thing I'd like consist of configuring an automatic connexion to the personnal network folder. I tried to use the attribute "NFSHomeDirectory" in several ways but this didn't worked. Do you have an idea on which attribute could I use to connect my user (sambaHomepath ?) and maybe how could I retrive my username/password to authenticate to it ? Thanks to all :)

1 0

Antw: [EXT] Slapd unexpectedly shutdown
by Ulrich Windl 07 Apr '20

07 Apr '20

>>> Kevin Olbrich <ko(a)sv01.de> schrieb am 06.04.2020 um 23:00 in Nachricht <15853_1586208569_5E8B9F39_15853_1729_1_CA+gLzy8cpURhV3Ti41im3Z=vRcq2VoEd0n_E+P8 EKnfN4=wPQ(a)mail.gmail.com>: > Hi! > > I'm experiencing an issue with Slapd 2.4.49 on Debian Buster. > I use Slapd as a proxy / lb with two AD nodes behind it. > > If I reboot one of the AD nodes, everything is fine. As soon as I > reboot the seconds one (while the first is back and available), > OpenLDAP shuts down immediately: > Apr 06 22:03:33 ldap-lb1.ldap.example.com slapd[22140]: Stopping > OpenLDAP: slapd. > Apr 06 22:03:33 ldap-lb1.ldap.example.com systemd[1]: slapd.service: > Succeeded. > > There is no traffic during this time and it matches the exact time > when node two is down. > > Debian still uses an init script for slapd but I did not find anything > interesting in it. > > Is there a config setting that I missed in the docs that explains this > behavior? > As it's not crashing, HA in systemd won't catch this issue. Start some tracing and logging I'd suggest. Something ust be triggering that, and you must capture the "something" before you can get a solution. > > Kind regards > Kevin

3 2

front end for openldap
by paulo bruck 07 Apr '20

07 Apr '20

Hi All I have been using openldap for many years and I would like to thanks to all . Is there a framewok to use with openldap as backend? Preferably based on Python 80) I look at django-ldapdb but project is almost dead and does not have all that I need. Flask has only autentication..8( Any ideas? thanks in advanced and again nice work 80)) -- Paulo Ricardo Bruck consultor tel 011 3596-4881/4882 011 98140-9184 (TIM) http://www.contatogs.com.br http://www.protejasuarede.com.br gpg AAA59989 at wwwkeys.us.pgp.net

5 5

Antw: [EXT] LMDB: sync'ing to disk and flash wear
by Ulrich Windl 07 Apr '20

07 Apr '20

>>> Alberto Mardegan <mardy(a)users.sourceforge.net> schrieb am 06.04.2020 um 08:44 in Nachricht <10444_1586183585_5E8B3DA1_10444_128_1_5863f87e-d26b-2943-9302-bf5bfc270e71@user .sourceforge.net>: > Hi all! > I'm trying to understand the impact that a LDMB database will have on > the flash wear of an embedded device. > > In order to minimize disk writes, I'm keeping a DB open all the time, > and I'd like to have the changes written into the physical storage only > when mdb_env_sync() is called (near the end of my process lifetime). > I'm opening the DB with the MDB_NOSYNC | MDB_WRITEMAP | MDB_NOMETASYNC > flags, and if I strace the executable I see that lmdb behaves as > expected: no writes happen until I call mdb_env_sync(). > > However, the writes end up to the physical storage anyway, because the > kernel reserves the right of flushing changes of an mmap'ed file to disk > at any time (as per the documentation of MAP_SHARED). I don't exactly > know if this happens because some other process is calling sync(), or > which criteria the kernel follows, but as a matter of fact a write > happens every few seconds. > > Looking at the code, it looks like it's impossible to instruct LMDB to > use MAP_PRIVATE without modifying the code. But before exploring that > solution, I'd like to be sure I understand the real behaviour of LMDB. Doesn't MAP_PRIVATE imply that the map can't be written to disk? > > Do I understand correctly, that if during the lifetime of my process the > same key is assigned different values, with mdb_txn_commit() being > called each time, the same addresses in the shared memory area will be > changed several times (leading to unnecessary re-writes of the same area > of the flash storage)? Or is LMDB only operating in "append" mode, so > that it tries to avoid writing the same area twice? I think no DB system can implement a commit with just one write. Why not put your DB im a RAM disk and then rsync to flash when done? Regards, Ulrich > > Thanks in advance for any answer, > Alberto > > -- > http://www.mardy.it - Geek in un lingua international

1 0

LMDB: sync'ing to disk and flash wear
by Alberto Mardegan 07 Apr '20

07 Apr '20

Hi all! I'm trying to understand the impact that a LDMB database will have on the flash wear of an embedded device. In order to minimize disk writes, I'm keeping a DB open all the time, and I'd like to have the changes written into the physical storage only when mdb_env_sync() is called (near the end of my process lifetime). I'm opening the DB with the MDB_NOSYNC | MDB_WRITEMAP | MDB_NOMETASYNC flags, and if I strace the executable I see that lmdb behaves as expected: no writes happen until I call mdb_env_sync(). However, the writes end up to the physical storage anyway, because the kernel reserves the right of flushing changes of an mmap'ed file to disk at any time (as per the documentation of MAP_SHARED). I don't exactly know if this happens because some other process is calling sync(), or which criteria the kernel follows, but as a matter of fact a write happens every few seconds. Looking at the code, it looks like it's impossible to instruct LMDB to use MAP_PRIVATE without modifying the code. But before exploring that solution, I'd like to be sure I understand the real behaviour of LMDB. Do I understand correctly, that if during the lifetime of my process the same key is assigned different values, with mdb_txn_commit() being called each time, the same addresses in the shared memory area will be changed several times (leading to unnecessary re-writes of the same area of the flash storage)? Or is LMDB only operating in "append" mode, so that it tries to avoid writing the same area twice? Thanks in advance for any answer, Alberto -- http://www.mardy.it - Geek in un lingua international

2 1

Openldap 2.4.49 with overlays syncrepl+ppolicy+chain+ldap weird behavior
by "POISSON Frédéric" 06 Apr '20

06 Apr '20

Hello, I'm doing a OpenLDAP test with a master/slave replication configuration including ppolicy overlay. I would like to enable password change from the slave replica with chain overlay, in order to validate the ppolicy olcPPolicyForwardUpdates attribute to TRUE. I'm using LDAPS from slave to master with SASL External authentication with client certificate. The client certificate correspond to a user DN entry with "manage" rights on the master server (the same used for the replication). This user DN has authzTo attribute in order to match the correct PROXYAUTHZ request from its dn to user DN. All of this configuration works on replica when i do first a failed authentication (err=49) on replica. The pwdFailureTime value is updated on the DN entry from replica to slave normally. I'm also able to do after some self entry update on some attribute such as password or others from replica to master. But the weird behavior is that i need to run first an failed authentication, otherwise if i try to change attribute on the slave server, it respond an err=80 "Error: ldap_back_is_proxy_authz returned 0, misconfigured URI?". The only way to retrieve correct behavior is to restart slapd, and redo one failed authentication first. It seems that the chain overlay do not connect the master server at startup Do you have any ideas why i have this behavior ? I'm using a 2.4.49 build of openldap, and inside logs on master server i see that the slave use the same connection. Here is the LDIF change and configuration on my replica : dn: olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: {0}chain olcChainReturnError: TRUE dn: olcDatabase={0}ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config changetype: add objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: {0}ldap olcDbURI: ldaps://valid7-lab-ldap1.tld olcDbIDAssertBind: bindmethod=sasl saslmech=external starttls=no tls_cert="/usr/local/openldap/etc/openldap-valid7/tls/db1_rid001_cert.pem" tls_key="/usr/local/openldap/etc/openldap-valid7/tls/db1_rid001_key.pem" tls_cacert="/usr/local/openldap/etc/openldap-valid7/tls/cacert.pem" tls_reqcert=demand tls_crlcheck=none mode=self olcDbRebindAsUser: TRUE dn: olcDatabase={1}mdb,cn=config changetype: modify replace: olcUpdateRef olcUpdateRef: ldaps://valid7-lab-ldap1.tld - dn: olcOverlay={1}ppolicy,olcDatabase={1}mdb,cn=config changetype: modify replace: olcPPolicyForwardUpdates olcPPolicyForwardUpdates: TRUE - Here is LDIF change on my master : dn: cn=config changetype: modify replace: olcAuthzPolicy olcAuthzPolicy: to - Thanks in advance for your reply -- Frederic Poisson

2 1

Slapd unexpectedly shutdown
by Kevin Olbrich 06 Apr '20

06 Apr '20

Hi! I'm experiencing an issue with Slapd 2.4.49 on Debian Buster. I use Slapd as a proxy / lb with two AD nodes behind it. If I reboot one of the AD nodes, everything is fine. As soon as I reboot the seconds one (while the first is back and available), OpenLDAP shuts down immediately: Apr 06 22:03:33 ldap-lb1.ldap.example.com slapd[22140]: Stopping OpenLDAP: slapd. Apr 06 22:03:33 ldap-lb1.ldap.example.com systemd[1]: slapd.service: Succeeded. There is no traffic during this time and it matches the exact time when node two is down. Debian still uses an init script for slapd but I did not find anything interesting in it. Is there a config setting that I missed in the docs that explains this behavior? As it's not crashing, HA in systemd won't catch this issue. Kind regards Kevin

1 0

Re: NetworkRadius CentOS pkg uses openldap-ltb which conflict with symas-openldap
by Dave Macias 02 Apr '20

02 Apr '20

On Thu, Mar 26, 2020 at 3:44 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > Try it and see? I can't find any concrete documentation one way or the > other, although it seems BuildRequires generally follows what Requires > does. You may need to ask the people who maintain RPM. > > There are other issues in the spec file, however, like: > > --with-libfreeradius-ldap-include-dir=/usr/local/openldap/include \ > --with-libfreeradius-ldap-lib-dir=/usr/local/openldap/lib64 \ > > are specific to LTB, might want to do something like they did around line > 447 to only do this if the LTB openldap is in use. > Awesome! Thank you very much for the input! Will report how things go -Dave

2 2

Multiple OpenLDAP client instances with the c library
by Lasa Martxel 02 Apr '20

02 Apr '20

Hello, I'm using the openldap c client library (2.4.45). I would like to somehow have two client instances (not necessarily simultaneously) within the same application, but I'm having issues with the second instance I create. I have not found a way to clear the global options so the new ones (different ca cerficiate, different client certificate) can be used with the second instance. With the second ldap_initialize, global options are already initialized. Same with the TLS context, it's initialized too. I have seen that the function that destroys the global options is called only when the program exits, or the dyn library is unloaded. Is this correct? Is this somehow a limitation of the library? Thank you, Martxel

2 4

AD proxy / CAPITAL letters in attributes
by Kevin Olbrich 31 Mar '20

31 Mar '20

Hi! How can I disable the behavior of CAPITAL letters when OpenLDAP proxies an AD? I know they should be case insensitive but I had to debug Rocketchat for two hours to find, they use sAMAccountName (case sensitive) and the app crashed because mine was named SAMACCOUNTNAME. (I will open a bug there but I bet there is a lot of broken SW). Kind regards Kevin

3 6

NetworkRadius CentOS pkg uses openldap-ltb which conflict with symas-openldap
by Dave Macias 26 Mar '20

26 Mar '20

Good day Everyone, Back Story: We wanted to install the latest release of Freeradius from NetworkRadius and got a conflict. See post: http://lists.freeradius.org/pipermail/freeradius-users/2020-March/097718.ht… Their response was of course, figure it out and fix it yourself, which I have no problem with. I personally never compiled a rpm file before but i think i have an idea of what needs to be adjusted on their specs file. Wanted to run my changes by you guys, if you could please kindly review.... https://github.com/davama/freeradius-server/commit/7fa0f49e25de874bb5034584… https://github.com/davama/freeradius-server/commit/dab208186d440196c297821f… Not too sure if "BuildRequires" uses the same syntax but "Requires" does, at least what it says here: https://rpm.org/user_doc/boolean_dependencies.html Hope it's clear. Please let me know, if you need any info from me. Any input is much appreciated! Thank you, Dave

3 3

OpenLDAP-Proxy in front of AD - Non-DN bind
by Kevin Olbrich 26 Mar '20

26 Mar '20

Hi! I'm new to OpenLDAP / Slapd and try to integrate it into our AD setup. I followed this howto: https://wiki.samba.org/index.php/OpenLDAP_as_proxy_to_AD ... and ended up with this config: https://bitbucket.org/code-orange/django-cdstack-tpl-openldap-proxy/src/mas… Proxy mode works fine, I can bind with DN and password. So far so good. TLS works perfectly. On AD, I can bind using either domain\username or username(a)example.com. Can I enable this again for my proxy? Atm this does not work: Invalid DN-Syntax, invalid DN. I try to provide a secure way to connect a remove machine to our AD to read the contacts (a pbx). Using the DN worked for some devices but some have issues because of the length. If the DN is several OUs deep, the string is to long. Thats why I would like to allow the sAMAccountName as username (or USN, etc.). How can I solve this? Do I need SASL for this? Thank you very much! Kind regards Kevin

1 0

issues while modifying the LDAP on Production
by Guni Hanchate 25 Mar '20

25 Mar '20

Hi, we are getting some issues while modifying the LDAP on Production. We restarted LDAP instance but same issue persist. I request you to suggest on this . Let us know if you need any further information . I can read an entry From Cricetid via the VirtIP [u5356968@cricetid ~]$ldapsearch -x -LLL -h 192.168.154.33 -b "o=mobistar.be" "uid=u5356968" cn dn: uid=u5356968,ou=Techmahindra,ou=Partners,o=mobistar.be cn: DEMOULIN Philippe From Mousedeer to Mousedeer u5356968@mousedeer # ldapsearch -x -LLL -p 3898 -h 192.168.154.97 -b "o=mobistar.be" "uid=u5356968" cn dn: uid=u5356968,ou=Techmahindra,ou=Partners,o=mobistar.be cn: DEMOULIN Philippe But we cannot modify the entry. u5356968@mousedeer # ldapmodify -p 3898 -h 192.168.154.97 -D"cn=directory manager, o=mobistar.be" -w8ZQ7HUJS dn: uid=013tes3477,ou=Dealer Users,ou=Partners,o=mobistar.be changetype: add add: mail mail: 013test.test_osp_fr_hq(a)orange.be adding new entry "uid=013tes3477,ou=Dealer Users,ou=Partners,o=mobistar.be" ldap_add: Undefined attribute type (17) additional info: add: attribute type undefined This is the error I get: Error while executing LDIF - [LDAP: error code 17 - Undefined Attribute Type] java.lang.Exception: [LDAP: error code 17 - Undefined Attribute Type] at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.checkResponse(DirectoryApiConnectionWrapper.java:1280) at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.access$600(DirectoryApiConnectionWrapper.java:109) at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper$4.run(DirectoryApiConnectionWrapper.java:726) at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.runAndMonitor(DirectoryApiConnectionWrapper.java:1175) at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.checkConnectionAndRunAndMonitor(DirectoryApiConnectionWrapper.java:1109) at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.modifyEntry(DirectoryApiConnectionWrapper.java:748) at org.apache.directory.studio.ldapbrowser.core.jobs.ImportLdifRunnable.importLdifRecord(ImportLdifRunnable.java:514) at org.apache.directory.studio.ldapbrowser.core.jobs.ImportLdifRunnable.importLdif(ImportLdifRunnable.java:272) at org.apache.directory.studio.ldapbrowser.core.jobs.ExecuteLdifRunnable.executeLdif(ExecuteLdifRunnable.java:157) at org.apache.directory.studio.ldapbrowser.core.jobs.ExecuteLdifRunnable.run(ExecuteLdifRunnable.java:123) at org.apache.directory.studio.ldapbrowser.core.jobs.UpdateEntryRunnable.run(UpdateEntryRunnable.java:59) at org.apache.directory.studio.connection.ui.RunnableContextRunner$1.run(RunnableContextRunner.java:112) at org.eclipse.jface.operation.ModalContext$ModalContextThread.run(ModalContext.java:121) [LDAP: error code 17 - Undefined Attribute Type]

3 4

logging through systemd-journald is bottleneck
by Markus.Storm＠t-systems.com 20 Mar '20

20 Mar '20

Dear all, we're currently testing performance of OpenLDAP on Oracle/RedHat Linux and quite unexpected actually hit systemd-journald to be a bottleneck. While OpenLDAP happily makes use of all available CPUs, that one is single threaded, braking everything. The only way around I have found is to set olcLoglevel to 0, speeding up my test run by a factor of 6(!). That now of course is not an option to use in production. I'd happily directly write to a file as I did in the old days but I cannot get olcLogfile to work. And even if I was able to get there, how do I stop OpenLDAP from logging to syslogd (which is inevitably forwarding everything to system-journald ....) ? Can anyone give advice how to handle this ? Any hint appreciated (short of "get a decent OS" - that is not an option). Thanks, Markus

3 3

Antw: [EXT] Re: logging through systemd-journald is bottleneck
by Ulrich Windl 19 Mar '20

19 Mar '20

>>> Dieter Klünter <dieter(a)dkluenter.de> schrieb am 18.03.2020 um 19:57 in Nachricht <30206_1584557842_5E726F12_30206_1570_1_20200318195706.1d992aa0(a)pink.fritz.box>: > Am Wed, 18 Mar 2020 17:16:53 +0000 > schrieb <Markus.Storm(a)t-systems.com>: > >> Dear all, >> >> we're currently testing performance of OpenLDAP on Oracle/RedHat >> Linux and quite unexpected actually hit systemd-journald to be a >> bottleneck. While OpenLDAP happily makes use of all available CPUs, >> that one is single threaded, braking everything. The only way around >> I have found is to set olcLoglevel to 0, speeding up my test run by a >> factor of 6(!). That now of course is not an option to use in >> production. I'd happily directly write to a file as I did in the old >> days but I cannot get olcLogfile to work. And even if I was able to >> get there, how do I stop OpenLDAP from logging to syslogd (which is >> inevitably forwarding everything to system-journald ....) ? Can >> anyone give advice how to handle this ? Any hint appreciated (short >> of "get a decent OS" - that is not an option). > > I support Qanah's advice! > Beside this, consider a logging strategy based on required information > and neglected information, as well as min. and max. server load. > > Based on my experience I would disable logging as default, but enable > logging for a short given time, just a modify operation on atribute > olcLogLevel. > With regard to journald I advice to define filters, see man > journalctl(1). > If syslog is a requirement, change to rsyslog. Don't make use of > logstash! Can't openLDAP simply log to a different port than the default syslog port? If so, just set up some alternate local syslog server. Or, in case an external syslog server is supported, just use one that isn't using systemd-journald. Sorry, I neved had the need to use a different syslog mechanism... > > -Dieter > > -- > Dieter Klünter | Systemberatung > http://sys4.de > GPG Key ID: E9ED159B > 53°37'09,95"N > 10°08'02,42"E

4 3

write ACL
by Thomas Elsäßer 18 Mar '20

18 Mar '20

Hi ACL Gurus i would like following ACL , but i'm to stupid. cn=app1,ou=application,dc=company,dc=de -> groupOfNames Our Customer Admins are here cn=GroupLdapAdmin,o=customer1,ou=customer,dc=company,dc=de -> groupOfNames cn=GroupLdapAdmin,o=customer2,ou=customer,dc=company,dc=de -> groupOfNames member is the admin of this tree example member=cn=customer2.admin,ou=user,o=customer2,ou=customer,dc=company,dc=de I have 600 Customerx How can i write one ACL for all customer to access to cn=app1,ou=application,dc=company,dc=de to write access for groupLDAPAdmin for every company? This work for one customer access to dn.regex="cn=([^,]),ou=application,dc=company,dc=de" by by set.expand="(user) & ([cn=GroupLdapAdmin,o=customer1,ou=customer,dc=company,dc=de])/member" write How can write this for all without write 600 ACL? Thanx and stays healthy Thomas

1 0

archiving test #2, ignore ;)
by Quanah Gibson-Mount 13 Mar '20

13 Mar '20

Ignore again.. -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: ldapsearch not working with '-H ldap://<IP_LDAP_server>/' option
by Thierry Debaene 12 Mar '20

12 Mar '20

Dear Quanah, Herewith the ldapwhoami without and with -H ldap:/// to compare. Regards, Thierry server# ldapwhoami -x -D "cn=Manager,dc=be" -w password -d -1 ldap_create ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying ::1 389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 attempting to connect: connect success ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x55c5863df610 ptr=0x55c5863df610 end=0x55c5863df636 len=38 0000: 30 24 02 01 01 60 1f 02 01 03 04 10 63 6e 3d 4d 0$...`......cn=M 0010: 61 6e 61 67 65 72 2c 64 63 3d 62 65 80 08 70 61 anager,dc=be..pa 0020: 73 73 77 6f 72 64 ssword ber_scanf fmt ({i) ber: ber_dump: buf=0x55c5863df610 ptr=0x55c5863df615 end=0x55c5863df636 len=33 0000: 60 1f 02 01 03 04 10 63 6e 3d 4d 61 6e 61 67 65 `......cn=Manage 0010: 72 2c 64 63 3d 62 65 80 08 70 61 73 73 77 6f 72 r,dc=be..passwor 0020: 64 d ber_flush2: 38 bytes to sd 3 0000: 30 24 02 01 01 60 1f 02 01 03 04 10 63 6e 3d 4d 0$...`......cn=M 0010: 61 6e 61 67 65 72 2c 64 63 3d 62 65 80 08 70 61 anager,dc=be..pa 0020: 73 73 77 6f 72 64 ssword ldap_write: want=38, written=38 0000: 30 24 02 01 01 60 1f 02 01 03 04 10 63 6e 3d 4d 0$...`......cn=M 0010: 61 6e 61 67 65 72 2c 64 63 3d 62 65 80 08 70 61 anager,dc=be..pa 0020: 73 73 77 6f 72 64 ssword ldap_result ld 0x55c5863d6050 msgid 1 wait4msg ld 0x55c5863d6050 msgid 1 (infinite timeout) wait4msg continue ld 0x55c5863d6050 msgid 1 all 1 ** ld 0x55c5863d6050 Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Thu Mar 12 08:33:07 2020 ** ld 0x55c5863d6050 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x55c5863d6050 request count 1 (abandoned 0) ** ld 0x55c5863d6050 Response Queue: Empty ld 0x55c5863d6050 response count 0 ldap_chkResponseList ld 0x55c5863d6050 msgid 1 all 1 ldap_chkResponseList returns ld 0x55c5863d6050 NULL ldap_int_select read1msg: ld 0x55c5863d6050 msgid 1 all 1 ber_get_next ldap_read: want=8, got=8 0000: 30 0c 02 01 01 61 07 0a 0....a.. ldap_read: want=6, got=6 0000: 01 00 04 00 04 00 ...... ber_get_next: tag 0x30 len 12 contents: ber_dump: buf=0x55c5863e0a80 ptr=0x55c5863e0a80 end=0x55c5863e0a8c len=12 0000: 02 01 01 61 07 0a 01 00 04 00 04 00 ...a........ read1msg: ld 0x55c5863d6050 msgid 1 message type bind ber_scanf fmt ({eAA) ber: ber_dump: buf=0x55c5863e0a80 ptr=0x55c5863e0a83 end=0x55c5863e0a8c len=9 0000: 61 07 0a 01 00 04 00 04 00 a........ read1msg: ld 0x55c5863d6050 0 new referrals read1msg: mark request completed, ld 0x55c5863d6050 msgid 1 request done: ld 0x55c5863d6050 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_dump: buf=0x55c5863e0a80 ptr=0x55c5863e0a83 end=0x55c5863e0a8c len=9 0000: 61 07 0a 01 00 04 00 04 00 a........ ber_scanf fmt (}) ber: ber_dump: buf=0x55c5863e0a80 ptr=0x55c5863e0a8c end=0x55c5863e0a8c len=0 ldap_msgfree ldap_extended_operation ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x55c5863df610 ptr=0x55c5863df610 end=0x55c5863df630 len=32 0000: 30 1e 02 01 02 77 19 80 17 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 34 32 30 33 2e 31 2e 31 31 2e 33 .4.1.4203.1.11.3 ber_scanf fmt ({) ber: ber_dump: buf=0x55c5863df610 ptr=0x55c5863df615 end=0x55c5863df630 len=27 0000: 77 19 80 17 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e w...1.3.6.1.4.1. 0010: 34 32 30 33 2e 31 2e 31 31 2e 33 4203.1.11.3 ber_flush2: 32 bytes to sd 3 0000: 30 1e 02 01 02 77 19 80 17 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 34 32 30 33 2e 31 2e 31 31 2e 33 .4.1.4203.1.11.3 ldap_write: want=32, written=32 0000: 30 1e 02 01 02 77 19 80 17 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 34 32 30 33 2e 31 2e 31 31 2e 33 .4.1.4203.1.11.3 ldap_result ld 0x55c5863d6050 msgid -1 wait4msg ld 0x55c5863d6050 msgid -1 (timeout 100000 usec) wait4msg continue ld 0x55c5863d6050 msgid -1 all 1 ** ld 0x55c5863d6050 Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Thu Mar 12 08:33:07 2020 ** ld 0x55c5863d6050 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x55c5863d6050 request count 1 (abandoned 0) ** ld 0x55c5863d6050 Response Queue: Empty ld 0x55c5863d6050 response count 0 ldap_chkResponseList ld 0x55c5863d6050 msgid -1 all 1 ldap_chkResponseList returns ld 0x55c5863d6050 NULL ldap_int_select read1msg: ld 0x55c5863d6050 msgid -1 all 1 ber_get_next ldap_read: want=8, got=8 0000: 30 21 02 01 02 78 1c 0a 0!...x.. ldap_read: want=27, got=27 0000: 01 00 04 00 04 00 8b 13 64 6e 3a 63 6e 3d 4d 61 ........dn:cn=Ma 0010: 6e 61 67 65 72 2c 64 63 3d 62 65 nager,dc=be ber_get_next: tag 0x30 len 33 contents: ber_dump: buf=0x55c5863e0a80 ptr=0x55c5863e0a80 end=0x55c5863e0aa1 len=33 0000: 02 01 02 78 1c 0a 01 00 04 00 04 00 8b 13 64 6e ...x..........dn 0010: 3a 63 6e 3d 4d 61 6e 61 67 65 72 2c 64 63 3d 62 :cn=Manager,dc=b 0020: 65 e read1msg: ld 0x55c5863d6050 msgid 2 message type extended-result ber_scanf fmt ({eAA) ber: ber_dump: buf=0x55c5863e0a80 ptr=0x55c5863e0a83 end=0x55c5863e0aa1 len=30 0000: 78 1c 0a 01 00 04 00 04 00 8b 13 64 6e 3a 63 6e x..........dn:cn 0010: 3d 4d 61 6e 61 67 65 72 2c 64 63 3d 62 65 =Manager,dc=be read1msg: ld 0x55c5863d6050 0 new referrals read1msg: mark request completed, ld 0x55c5863d6050 msgid 2 request done: ld 0x55c5863d6050 msgid 2 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 2, msgid 2) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_dump: buf=0x55c5863e0a80 ptr=0x55c5863e0a83 end=0x55c5863e0aa1 len=30 0000: 78 1c 0a 01 00 04 00 04 00 8b 13 64 6e 3a 63 6e x..........dn:cn 0010: 3d 4d 61 6e 61 67 65 72 2c 64 63 3d 62 65 =Manager,dc=be ber_scanf fmt (x) ber: ber_dump: buf=0x55c5863e0a80 ptr=0x55c5863e0a8c end=0x55c5863e0aa1 len=21 0000: 8b 13 64 6e 3a 63 6e 3d 4d 61 6e 61 67 65 72 2c ..dn:cn=Manager, 0010: 64 63 3d 62 65 dc=be ber_scanf fmt (}) ber: ber_dump: buf=0x55c5863e0a80 ptr=0x55c5863e0aa1 end=0x55c5863e0aa1 len=0 ldap_parse_extended_result ber_scanf fmt ({eAA) ber: ber_dump: buf=0x55c5863e0a80 ptr=0x55c5863e0a83 end=0x55c5863e0aa1 len=30 0000: 78 1c 0a 01 00 04 00 04 00 8b 13 64 6e 3a 63 6e x..........dn:cn 0010: 3d 4d 61 6e 61 67 65 72 2c 64 63 3d 62 65 =Manager,dc=be ber_scanf fmt (O) ber: ber_dump: buf=0x55c5863e0a80 ptr=0x55c5863e0a8c end=0x55c5863e0aa1 len=21 0000: 8b 13 64 6e 3a 63 6e 3d 4d 61 6e 61 67 65 72 2c ..dn:cn=Manager, 0010: 64 63 3d 62 65 dc=be dn:cn=Manager,dc=be ldap_msgfree ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 3 0000: 30 05 02 01 03 42 00 0....B. ldap_write: want=7, written=7 0000: 30 05 02 01 03 42 00 0....B. ldap_free_connection: actually freed server# ldapwhoami -x -H ldap://192.168.100.11/ -D "cn=Manager,dc=be" -w password -d -1 ldap_url_parse_ext(ldap://192.168.100.11/) ldap_create ldap_url_parse_ext(ldap://192.168.100.11:389/??base) ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 192.168.100.11:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 192.168.100.11:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 attempting to connect: connect success ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x559745d846c0 ptr=0x559745d846c0 end=0x559745d846e6 len=38 0000: 30 24 02 01 01 60 1f 02 01 03 04 10 63 6e 3d 4d 0$...`......cn=M 0010: 61 6e 61 67 65 72 2c 64 63 3d 62 65 80 08 70 61 anager,dc=be..pa 0020: 73 73 77 6f 72 64 ssword ber_scanf fmt ({i) ber: ber_dump: buf=0x559745d846c0 ptr=0x559745d846c5 end=0x559745d846e6 len=33 0000: 60 1f 02 01 03 04 10 63 6e 3d 4d 61 6e 61 67 65 `......cn=Manage 0010: 72 2c 64 63 3d 62 65 80 08 70 61 73 73 77 6f 72 r,dc=be..passwor 0020: 64 d ber_flush2: 38 bytes to sd 3 0000: 30 24 02 01 01 60 1f 02 01 03 04 10 63 6e 3d 4d 0$...`......cn=M 0010: 61 6e 61 67 65 72 2c 64 63 3d 62 65 80 08 70 61 anager,dc=be..pa 0020: 73 73 77 6f 72 64 ssword ldap_write: want=38, written=38 0000: 30 24 02 01 01 60 1f 02 01 03 04 10 63 6e 3d 4d 0$...`......cn=M 0010: 61 6e 61 67 65 72 2c 64 63 3d 62 65 80 08 70 61 anager,dc=be..pa 0020: 73 73 77 6f 72 64 ssword ldap_result ld 0x559745d7b070 msgid 1 wait4msg ld 0x559745d7b070 msgid 1 (infinite timeout) wait4msg continue ld 0x559745d7b070 msgid 1 all 1 ** ld 0x559745d7b070 Connections: * host: 192.168.100.11 port: 389 (default) refcnt: 2 status: Connected last used: Wed Mar 11 20:54:07 2020 ** ld 0x559745d7b070 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x559745d7b070 request count 1 (abandoned 0) ** ld 0x559745d7b070 Response Queue: Empty ld 0x559745d7b070 response count 0 ldap_chkResponseList ld 0x559745d7b070 msgid 1 all 1 ldap_chkResponseList returns ld 0x559745d7b070 NULL ldap_int_select read1msg: ld 0x559745d7b070 msgid 1 all 1 ber_get_next ldap_read: want=8, got=0 ber_get_next failed. ldap_err2string ldap_result: Can't contact LDAP server (-1) ldap_free_request (origid 1, msgid 1) ldap_free_connection 1 1 ldap_free_connection: actually freed Op do 12 mrt. 2020 om 00:04 schreef Quanah Gibson-Mount <quanah(a)symas.com>: > > > --On Wednesday, March 11, 2020 9:59 PM +0100 Thierry Debaene > <thierry.debaene(a)gmail.com> wrote: > > > > > ldap_chkResponseList returns ld 0x55bbbd3ec070 NULL > > ldap_int_select > > read1msg: ld 0x55bbbd3ec070 msgid 1 all 1 > > ber_get_next > > ldap_read: want=8, got=0 > > It successfully connected to port 389 on that IP address, but got no > response back from whatever is listening to that port on that IP address. > I'd suggest comparing the output to the same command with no -H option > specified. > > --Quanah > >

1 1

Re: ldapsearch not working with '-H ldap://<IP_LDAP_server>/' option
by Thierry Debaene 12 Mar '20

12 Mar '20

Dear Quanah, Herewith the requested info. Thanks a lot for you help and time ! Kind Regards, Thierry client# ldapwhoami -x -H ldap://192.168.100.11/ -D "cn=Manager,dc=be" -w password -d 1 ldap_url_parse_ext(ldap://192.168.100.11/) ldap_create ldap_url_parse_ext(ldap://192.168.100.11:389/??base) ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 192.168.100.11:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 192.168.100.11:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 attempting to connect: connect success ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({i) ber: ber_flush2: 38 bytes to sd 3 ldap_result ld 0x55d49a4a3070 msgid 1 wait4msg ld 0x55d49a4a3070 msgid 1 (infinite timeout) wait4msg continue ld 0x55d49a4a3070 msgid 1 all 1 ** ld 0x55d49a4a3070 Connections: * host: 192.168.100.11 port: 389 (default) refcnt: 2 status: Connected last used: Wed Mar 11 20:32:08 2020 ** ld 0x55d49a4a3070 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x55d49a4a3070 request count 1 (abandoned 0) ** ld 0x55d49a4a3070 Response Queue: Empty ld 0x55d49a4a3070 response count 0 ldap_chkResponseList ld 0x55d49a4a3070 msgid 1 all 1 ldap_chkResponseList returns ld 0x55d49a4a3070 NULL ldap_int_select read1msg: ld 0x55d49a4a3070 msgid 1 all 1 ber_get_next ldap_err2string ldap_result: Can't contact LDAP server (-1) ldap_free_request (origid 1, msgid 1) ldap_free_connection 1 1 ldap_free_connection: actually freed server# ldapwhoami -x -D "uid=thierry,ou=People,ou=linux,dc=be" -w password -d 1 ldap_create ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying ::1 389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 attempting to connect: connect success ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({i) ber: ber_flush2: 58 bytes to sd 3 ldap_result ld 0x563d667e3060 msgid 1 wait4msg ld 0x563d667e3060 msgid 1 (infinite timeout) wait4msg continue ld 0x563d667e3060 msgid 1 all 1 ** ld 0x563d667e3060 Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Wed Mar 11 20:30:44 2020 ** ld 0x563d667e3060 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x563d667e3060 request count 1 (abandoned 0) ** ld 0x563d667e3060 Response Queue: Empty ld 0x563d667e3060 response count 0 ldap_chkResponseList ld 0x563d667e3060 msgid 1 all 1 ldap_chkResponseList returns ld 0x563d667e3060 NULL ldap_int_select read1msg: ld 0x563d667e3060 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 12 contents: read1msg: ld 0x563d667e3060 msgid 1 message type bind ber_scanf fmt ({eAA) ber: read1msg: ld 0x563d667e3060 0 new referrals read1msg: mark request completed, ld 0x563d667e3060 msgid 1 request done: ld 0x563d667e3060 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (}) ber: ldap_msgfree ldap_extended_operation ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush2: 32 bytes to sd 3 ldap_result ld 0x563d667e3060 msgid -1 wait4msg ld 0x563d667e3060 msgid -1 (timeout 100000 usec) wait4msg continue ld 0x563d667e3060 msgid -1 all 1 ** ld 0x563d667e3060 Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Wed Mar 11 20:30:44 2020 ** ld 0x563d667e3060 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x563d667e3060 request count 1 (abandoned 0) ** ld 0x563d667e3060 Response Queue: Empty ld 0x563d667e3060 response count 0 ldap_chkResponseList ld 0x563d667e3060 msgid -1 all 1 ldap_chkResponseList returns ld 0x563d667e3060 NULL ldap_int_select read1msg: ld 0x563d667e3060 msgid -1 all 1 ber_get_next ber_get_next: tag 0x30 len 53 contents: read1msg: ld 0x563d667e3060 msgid 2 message type extended-result ber_scanf fmt ({eAA) ber: read1msg: ld 0x563d667e3060 0 new referrals read1msg: mark request completed, ld 0x563d667e3060 msgid 2 request done: ld 0x563d667e3060 msgid 2 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 2, msgid 2) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (x) ber: ber_scanf fmt (}) ber: ldap_parse_extended_result ber_scanf fmt ({eAA) ber: ber_scanf fmt (O) ber: dn:uid=thierry,ou=People,ou=linux,dc=be ldap_msgfree ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 3 ldap_free_connection: actually freed Op wo 11 mrt. 2020 om 18:15 schreef Quanah Gibson-Mount <quanah(a)symas.com>: > > > --On Wednesday, March 11, 2020 10:08 AM +0100 Thierry Debaene > <thierry.debaene(a)gmail.com> wrote: > > > > > > > Dear Quanah, OpenLDAPs, > > > > > > Herewith the proof that slapd is listening on port 389. > > I also included the slapd.conf, /etc/sysconfig/slapd and ldap.conf files. > > I would: > > a) Start with ldapwhoami (rather than ldapsearch), just for simplicity > b) add a -d -1 for full client side debugging to see where it's getting > hung up > > --Quanah > > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 2

Information about source code of mobiuniquemember
by HANCHATE Ravikiran (u5574292) 11 Mar '20

11 Mar '20

Dear, we need information about source code of mobiuniquemember. How can we find source code of mobiuniquemember for our Opneldap infra ? Kindly assist here . Regards, Ravikiran. *********DISCLAIMER********* This electronic transmission (and any attached document) is intended exclusively for the person or entity to whom it is addressed and may contain confidential and/or privileged material. Any disclosure, copying, distribution or other action based upon the information by persons or entities other than the intended recipient is prohibited. If you receive this message in error, please contact the sender and delete the material from any and all computers. Orange Belgium does not warrant a proper and complete transmission of this information, nor does it accept liability for any delays. Unless clearly and unambiguously stated otherwise, the content of this e-mail and its attachment is provided to you for information purposes only, and nothing herein shall be binding upon, or shall constitute or be construed as a binding offer of Orange Belgium. *****END OF DISCLAIMER*****

2 1

Re: ldapsearch not working with '-H ldap://<IP_LDAP_server>/' option
by Thierry Debaene 11 Mar '20

11 Mar '20

Dear Quanah, OpenLDAPs, Herewith the proof that slapd is listening on port 389. I also included the slapd.conf, /etc/sysconfig/slapd and ldap.conf files. Regards, Thierry # netstat -ltn Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:8080 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp6 0 0 :::389 :::* LISTEN tcp6 0 0 :::3306 :::* LISTEN tcp6 0 0 :::22 :::* LISTEN # nc -zv 192.168.100.11 389 Ncat: Version 7.50 ( https://nmap.org/ncat ) Ncat: Connected to 192.168.100.11:389. Ncat: 0 bytes sent, 0 bytes received in 0.01 seconds. # cat /etc/openldap/slapd.conf include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/ppolicy.schema allow bind_v2 idletimeout 10 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/lib64/openldap moduleload ppolicy.la moduleload syncprov password-hash {CRYPT} password-crypt-salt-format "$6$%.86s" access to * by * read database bdb suffix "dc=be" rootdn "cn=Manager,dc=be" rootpw {CRYPT}$6$DAn/HuEvv8oxXzht$4...k4ZUiJG4qUKzqUTCQVtuUY1 directory /var/lib/ldap index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=be" ppolicy_use_lockout # cat /etc/sysconfig/slapd SLAPD_URLS="ldapi:/// ldap:///" # cat /etc/openldap/ldap.conf #TLS_CACERTDIR /etc/openldap/certs #TLS_CACERTDIR /etc/openldap/cacerts TLS_REQCERT never SASL_NOCANON on Op di 10 mrt. 2020 om 19:42 schreef Quanah Gibson-Mount <quanah(a)symas.com>: > --On Tuesday, March 10, 2020 12:03 PM +0100 Thierry Debaene > <thierry.debaene(a)gmail.com> wrote: > > ># ldapsearch -x -H ldap://192.168.100.11 -D > ># "uid=thierry,ou=People,ou=linux,dc=be" -w password -b ou=linux,dc=be > ># -LLL memberUid -v > > ldap_initialize( ldap://192.168.100.11:389/??base ) > > ldap_result: Can't contact LDAP server (-1) > > Please provide evidence that slapd is listening to 192.168.100.11 on port > 389 and that it can be accessed (i.e., no firewall etc blocking access). > > For example on my local system: > > nc -zv 10.2.0.74 389 > Connection to 10.2.0.74 389 port [tcp/ldap] succeeded! > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

ldapsearch not working with '-H ldap://<IP_LDAP_server>/' option
by Thierry Debaene 10 Mar '20

10 Mar '20

Hello OpenLDAPs, Any LDAP search request with '-H ldap://<IP_LDAP_server>/' option returns 'Can't contact LDAP server (-1)' (see below). When the '-H ...' option is left out or when '-H ldap:///' is used, the expected result is returned (see below). The 'ldapsearch -x -H ldap://<IP_LDAP_server>/ ...' behaves the same from the server as from a client on the same LAN. Thanks for helping me to get rid of this problem. Thierry # ldapsearch -x -H ldap://192.168.100.11 -D "uid=thierry,ou=People,ou=linux,dc=be" -w password -b ou=linux,dc=be -LLL memberUid -v ldap_initialize( ldap://192.168.100.11:389/??base ) ldap_result: Can't contact LDAP server (-1) # ldapsearch -x -D "uid=thierry,ou=People,ou=linux,dc=be" -w password -b ou=linux,dc=be -LLL memberUid -v ldap_initialize( <DEFAULT> ) filter: (objectclass=*) requesting: memberUid dn: cn=thierry,ou=Group,ou=linux,dc=be memberUid: thierry # ldapsearch -x -H ldap:/// -D "uid=thierry,ou=People,ou=linux,dc=be" -w password -b ou=linux,dc=be -LLL memberUid -v ldap_initialize( ldap://:389/??base ) filter: (objectclass=*) requesting: memberUid memberUid: thierry

2 1

Re: back-ldap SASL proxy authorization
by Dieter Bocklandt 09 Mar '20

09 Mar '20

Hi Quanah, Of course! Submitted this as ITS#9179. Regards, //Dieter On Fri, 6 Mar 2020 at 17:52, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Thursday, March 5, 2020 8:04 PM +0000 Howard Chu <hyc(a)symas.com> > wrote: > > >> Actually, I spent some more time on this today and I /think/ I might > >> know what's happening here: > > > > Your analysis makes sense. Would have to ask Pierangelo why he wrote it > > the way he did but it seems that it should use op->o_ndn. > > Hi Dieter, > > Can you file an ITS on this issue at http://www.openldap.org/its > including > your analysis? > > Thanks! > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Memory mapping questions
by Sam Dave 09 Mar '20

09 Mar '20

Hi, 1. Is it possible to disable memory mapping in LMDB? 2. If I create a brand-new database and write data into it (but haven't read it yet) can I be assured it won't be memory-mapped yet? The purpose of these question is to get more consistent/reproducible time benchmarks for some stuff I'm doing. (As you know the drive vs. memory-mapped performance varies heavily.) Thanks, Sam

3 3

Re: back-ldap SASL proxy authorization
by Dieter Bocklandt 06 Mar '20

06 Mar '20

Hey Quanah, Thanks for getting back to me! So as I understood it, I expected the proxied identity to be the identity that the client successfully authorized as instead of the identity it initially started with. The session tracking request is just there to confirm that piece of information is actually present but not used. That initial identity is also used for ACL evaluation on the producer side, leading to insufficient access (as expected). To give a maybe more clear example, assume the following users (stripped down to just the relevant attributes in play): *dn: cn=proxy,ou=System,dc=example,dc=netauthzTo: dn:** *dn: cn=service,ou=System,dc=example,dc=net * *authzTo: dn:uid=user,ou=People,dc=example,dc=net * *dn: uid=dieter,ou=People,dc=example,dc=net * *and the following idassert config:* *olcDbIDAssertBind: mode=self flags=override,prescriptive tls_reqcert=never bindmethod=sasl saslmech=plain authcID=proxy credentials=XXXXX * When I perform an operation like this: ldapmodify -H ldaps://ldapserver -Y PLAIN -U service -X dn:uid=dieter,ou=People,dc=example,dc=net -w servicepassword -f modifications.ldif I would assume the following takes place: - The service user binds to the consumer and assumes dieter's identity, which should be the same net effect as binding with dieter's user in the first place. - The proxy user binds to the provider and assumes dieter's identity - The provider tries to perform the write, using dieter's identity for ACL evaluation What actually happens: - The service user binds to the consumer and assumes dieter's identity - The proxy user binds to the provider and assumes the service user's identity - The provider tries to perform the write, using the service user's identity for ACL evaluation Actually, I spent some more time on this today and I *think* I might know what's happening here: (from servers/slapd/back-ldap/bind.c in master): line 2222 - 2227: *if ( !BER_BVISNULL( &op->o_conn->c_ndn ) ) { ndn = op->o_conn->c_ndn; } else { ndn = op->o_ndn; }* line 2549 - 2557: *if ( op->o_tag == LDAP_REQ_BIND ) { ndn = op->o_req_ndn; } else if ( !BER_BVISNULL( &op->o_conn->c_ndn ) ) { ndn = op->o_conn->c_ndn; } else { ndn = op->o_ndn; }* It seems it tries to use op->o_conn->c_ndn if it's not null, which is (correct me if I'm wrong) the original authcID. That value however doesn't change when performing a proxy authorization, while op->o_ndn does properly reflect that. Shouldn't OpenLDAP always use op->o_ndn? Again, let me know if I can provide more information or tell me if I'm grossly misunderstanding how this is all supposed to work in the first place :) Thanks! // Dieter On Wed, 4 Mar 2020 at 23:12, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Friday, February 28, 2020 11:11 PM +0100 Dieter Bocklandt > <dieterbocklandt(a)gmail.com> wrote: > > > However, we also have a service using SASL proxy authorization, in which > > case the authcid is used in the ProxyAuthz instead of the authorized > > authzid. > > > > Feb 28 22:02:38 ldap-master-az2 slapd[1915]: conn=26858 op=2 PROXYAUTHZ > > dn="cn=service,ou=system,dc=internal,dc=machines" > > Feb 28 22:02:38 ldap-master-az2 slapd[1915]: conn=26858 op=2 > > [IP=10.243.72.199 USERNAME=cn=enduser,ou=People,dc=example,dc=net] MOD > > dn="uid=sys.cp.test,ou=People,dc=internal,dc=machines" > > > > Am I misunderstanding how this is supposed to work, am I hitting a > > certain limitation or maybe a bug? Let me know if you need any more > > details! > > This looks to me like it: > > a) Logs what the proxied identity is (PROXYAUTHZ > dn="cn=service,ou=system,dc=internal,dc=machine") > > b) Logs what the actual identity making the changes is > (USERNAME=cn=enduser,ou=People,dc=example,dc=net) and what IP address it > came from (IP=10.243.72.199) so that if questions arise about who made a > change, those questions can be answered from the logs. > > I.e., I see both bits of information provided in the connection operation. > > What makes you think you are hitting a limitation or a bug? > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

4 3

Re: openldap-technical Digest, Vol 148, Issue 6
by Dieter Bocklandt 06 Mar '20

06 Mar '20

Hey Michael, I would assume that for the proxy it shouldn't matter how the client got authenticated to the consumer. Mode=self should just try and assert the resulting authzID to the target. The identity of the proxy is only there so we have something to bind with to the producer. With mode=none, that identity would also be used for the actual ACL evaluation, but that would just lead to all writes being done by seemingly 1 user, making auditing impossible ... Cheers, //Dieter On Fri, 6 Mar 2020 at 13:00, <openldap-technical-request(a)openldap.org> wrote: > > ---------- Forwarded message ---------- > From: "Michael Ströder" <michael(a)stroeder.com> > To: openldap-technical(a)openldap.org > Cc: > Bcc: > Date: Thu, 5 Mar 2020 21:46:12 +0100 > Subject: Re: back-ldap SASL proxy authorization > On 3/5/20 9:04 PM, Howard Chu wrote: > > Dieter Bocklandt wrote: > >> I would assume the following takes place: > >> - The service user binds to the consumer and assumes dieter's identity, > which should be the same net effect as binding with dieter's user in the > first place. > >> - The proxy user binds to the provider and assumes dieter's identity > >> - The provider tries to perform the write, using dieter's identity for > ACL evaluation > >> > >> What actually happens: > >> - The service user binds to the consumer and assumes dieter's identity > >> - The proxy user binds to the provider and assumes the service user's > identity > >> - The provider tries to perform the write, using the service user's > identity for ACL evaluation > >> > >> Actually, I spent some more time on this today and I /think/ I might > know what's happening here: > > > > Your analysis makes sense. Would have to ask Pierangelo why he wrote it > the way he > > did but it seems that it should use op->o_ndn. > > Hmm, is the semantics of proxying the SASL proxy authorization clearly > defined? The consumer proxy itself also has an identity. > > Just asking... > > Ciao, Michael. > > > _______________________________________________ > openldap-technical mailing list > openldap-technical(a)openldap.org > http://www.openldap.org/lists/mm/listinfo/openldap-technical >

1 0

Antw: [EXT] Re: pwdChangedTime not defined when creating new entry
by Ulrich Windl 05 Mar '20

05 Mar '20

>>> Dieter Klünter <dieter(a)dkluenter.de> schrieb am 05.03.2020 um 10:10 in Nachricht <25580_1583399661_5E60C2EC_25580_1796_1_20200305101027.4c15a1d1(a)pink.fritz.box>: > Am Wed, 04 Mar 2020 13:36:08 +0000 > schrieb Manuela Mandache <manuela.mandache(a)protonmail.com>: > >> Hello all, >> >> We have a directory running on OpenLDAP 2.4.44 with the ppolicy >> overlay on the main database. When a new entry with a userPassword >> defined is created, pwdChangedTime is not defined, so this initial >> userPassword never expires. >> >> The directory has been migrated from its OpenLDAP 2.3.34 instance >> (yes, we missed some steps...), and there the pwdChangedTime is set, >> and naturally equal to createTimestamp. >> >> The overlay is configured as follows: >> dn: olcOverlay={2}ppolicy,olcDatabase={2}mdb,cn=config >> objectClass: olcOverlayConfig >> objectClass: olcPPolicyConfig >> olcOverlay: {2}ppolicy >> olcPPolicyDefault: ou=ppolicy,dc=example,dc=com >> olcPPolicyHashCleartext: TRUE >> olcPPolicyUseLockout: TRUE >> >> Is there a parameter I missed which would switch on setting >> pwdChangedTime at entry creation? Do I have to provide some other >> configuration elements? >> >> Or is it unreasonable to expect this initialisation of the attribute >> this way, and only a password change can set it? I think the setting >> at creation is rather handy... Using pwdMustChange would be >> difficult, we have a lot of client apps which would be forced to >> check and probably adapt their authentication procedures. > [...] > The password attribute value must be set by a password modify exented > operation in order to set password policy in effect, see man > slapo-ppolicy(5) Yes, but shouldn't there be some magic to add it to all existing passweords when enabling it? Without having each user to change the password... > > -Dieter > > -- > Dieter Klünter | Systemberatung > http://sys4.de > GPG Key ID: E9ED159B > 53°37'09,95"N > 10°08'02,42"E

2 1

back-ldap SASL proxy authorization
by Dieter Bocklandt 04 Mar '20

04 Mar '20

Hi! We have a fairly standard OpenLDAP setup (on 2.4.49) running well, where our replica instances chain writes back to the master using the chain overlay. Relevant bits of configuration we're using below: dn: olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: {0}chain olcChainCacheURI: FALSE olcChainMaxReferralDepth: 1 olcChainReturnError: TRUE dn: olcDatabase={0}ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: {0}ldap olcDbIDAssertBind: mode=self flags=override,prescriptive tls_reqcert=never bindmethod=sasl saslmech=plain authcID=proxy credentials=XXXXX olcDbRebindAsUser: TRUE olcDbChaseReferrals: TRUE olcDbProxyWhoAmI: TRUE olcDbProtocolVersion: 3 olcDbSingleConn: FALSE olcDbCancel: abandon olcDbUseTemporaryConn: FALSE olcDbConnectionPoolMax: 8 olcDbSessionTrackingRequest: TRUE olcDbNoRefs: FALSE olcDbNoUndefFilter: FALSE olcDbIdleTimeout: 5 . . . dn: cn=proxy,ou=System,dc=example,dc=net cn: proxy objectClass: simpleSecurityObject objectClass: organizationalRole userPassword: XXXXX authzTo: {0}dn.regex:^uid=[^,],ou=People,dc=example,dc=net$ Above works great, with the client identity being authorized through the ProxyAuthz control. However, we also have a service using SASL proxy authorization, in which case the authcid is used in the ProxyAuthz instead of the authorized authzid. Ldapwhoami works as expected and the username mentioned in the session tracking request (visible in the producer's logs) is actually the authzdn (being cn=enduser,ou=People,dc=example,dc=net in this example, whereas cn=service,ou=system,dc=internal,dc=machines is the authcdn): ldapwhoami -H ldaps://$(cat /etc/service_hostname) -U service -X dn:cn=enduser,ou=People,dc=example,dc=net -Y PLAIN SASL/PLAIN authentication started Please enter your password: SASL username: dn:cn=enduser,ou=People,dc=example,dc=net SASL SSF: 0 dn:cn=enduser,ou=People,dc=example,dc=net Feb 28 22:02:38 ldap-master-az2 slapd[1915]: conn=26858 op=2 PROXYAUTHZ dn="cn=service,ou=system,dc=internal,dc=machines" Feb 28 22:02:38 ldap-master-az2 slapd[1915]: conn=26858 op=2 [IP=10.243.72.199 USERNAME=cn=enduser,ou=People,dc=example,dc=net] MOD dn="uid=sys.cp.test,ou=People,dc=internal,dc=machines" Feb 28 22:02:38 ldap-master-az2 slapd[1915]: conn=26858 op=2 [IP=10.243.72.199 USERNAME=cn=enduser,ou=People,dc=example,dc=net] MOD attr=klarnaItNote Feb 28 22:02:38 ldap-master-az2 slapd[1915]: conn=26858 op=2 [IP=10.243.72.199 USERNAME=cn=enduser,ou=People,dc=example,dc=net] RESULT tag=103 err=0 text= Am I misunderstanding how this is supposed to work, am I hitting a certain limitation or maybe a bug? Let me know if you need any more details! Thanks! Dieter Bocklandt

2 1

identifying anonymouns binds
by Geert Hendrickx 04 Mar '20

04 Mar '20

Hi I'd like to inventorise (and eventually disable) anynomous binds on an LDAP server with many different client applications. I am evaluating stats logs, and I see that most anonymous binds are logged as: conn=32743 op=0 BIND dn="" method=128 conn=32743 op=0 RESULT tag=97 err=0 text= However some connections log no BIND operation at all, just SRCH ops etc. I cannot replicate this behaviour with ldapsearch, it comes from an old java client. So looking for 'BIND dn=""' is not enough - how can I reliably identify anonymous binds? Looking for each op=0 and if it's not a SRCH, assume it's an anonymous bind as well? We have no "features" like bind_v2, bind_anon_cred etc enabled. Second question is what is the proper way to disable anonymous access? Through access controls (which we already have in place for fine-grained write access control), or on server-wide level by 'disallow bind_anon' ? Thanks Geert -- geert.hendrickx.be :: geert(a)hendrickx.be :: PGP: 0xC4BB9E9F This e-mail was composed using 100% recycled spam messages!

2 1

ldap_sasl_interactive_bind_s: Local error (-2) for SASL/GSS-SPNEGO
by Debashis Chaki 02 Mar '20

02 Mar '20

Hi , I have installed openldap but I am getting the following error while executing some basic command using SASL/GSS-SPNEGO authentication Where as SASL/EXTERNAL authentication working perfectly. [root@dtgldap103 LdapCfg]# ldapsearch SASL/GSS-SPNEGO authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (SPNEGO cannot find mechanisms to negotiate) [root@dtgldap103 LdapCfg]# ldapwhoami SASL/GSS-SPNEGO authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (SPNEGO cannot find mechanisms to negotiate) [root@dtgldap103 LdapCfg]# ldapsearch -LLL -s base -b '' '(objectClass=*)' + SASL/GSS-SPNEGO authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (SPNEGO cannot find mechanisms to negotiate) [root@dtgldap103 LdapCfg]# ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config olcDatabase=config SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: olcDatabase=config # requesting: ALL # # {0}config, config dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth" manage by * none # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 [root@dtgldap103 openldap]# rpm -qa | grep ldap sssd-ldap-1.15.2-50.el7_4.2.x86_64 openldap-clients-2.4.44-5.el7.x86_64 openldap-servers-sql-2.4.44-5.el7.x86_64 openldap-servers-2.4.44-5.el7.x86_64 compat-openldap-2.3.43-5.el7.x86_64 openldap-devel-2.4.44-5.el7.x86_64 openldap-2.4.44-5.el7.x86_64 nss-pam-ldapd-0.8.13-8.0.1.el7.x86_64 Please help me how can I get out of this issue ? I am not able to proceed further for our openldap project without that. Please let me know if you need any more details. Thanks & Regards <http://www.proquest.com/> Debashis Chaki ProQuest | The Quorum, Barnwell Road | Cambridge | CB5 8SW | UK debashis.chaki(a)proquest.com tel: +44 (0)1223 271257 Better research. Better learning. Better insights.

2 3

Re: With MDB Openldap seems to be pretty slower in Windows
by Vijay Kumar 01 Mar '20

01 Mar '20

Thank Quanah, for the response. Can i request to let me know what is WSLv2 you meant for? -Vijay Kumar On Fri, Feb 28, 2020 at 10:52 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Friday, February 28, 2020 8:58 AM -0800 Quanah Gibson-Mount > <quanah(a)symas.com> wrote: > > >> We have a 110 users data by performance testing, where we observed > >> slowness for windows 10 OS. > > > > This is not a topic for -devel, please post to -technical instead. > > Ugh, even worse, you double posted. DO NOT DOUBLE POST. > > I would suggest testing WSLv2. ;) > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > -- Thanks & Regards, Vijay Kumar *+91-94944 44009*

2 1

SASL domain no longer recognised
by Rick van Rein 01 Mar '20

01 Mar '20

Hello, I have a demo setup with slapd on Debian Stable, and a while back followed Debian's Switch to Buster, with slapd 2.4.47. Since about that time, slapd stopped recognising its SASL realm. This is in a dev/demo/test environment in Docker, so naming is a bit silly, but that always worked. Config and such are shown at https://github.com/arpa2/docker-demo/tree/master/demo-reservoir Using "ldapsearch -Y GSSAPI -H ldap://reservoir.arpa2:1388 -b ou=Reservoir,o=arpa2.net,ou=InternetWide" gives the message SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (No key table entry found matching ldap/reservoir.arpa2@) **In this output, note the lacking realm after the @.** This appears to be a server-side issue, because the client had the realm in the klist output and that name is present in the keytab: 02/29/20 11:54:53 02/29/20 21:47:26 ldap/reservoir.arpa2(a)ARPA2.NET renew until 03/01/20 11:47:22 The configuration of the server in /etc/ldap/slapd.conf still says: sasl-host reservoir.arpa2 sasl-realm ARPA2.NET FWIW, slapd runs as /usr/sbin/slapd -d any -h "ldapi://%2ftmp%2fldap-socket ldap://:1388/" Have I missed changes to slapd? Are there log messages that I overlooked (or should selected for)? Thanks! -Rick

1 0

commit vs abort
by Sam Dave 29 Feb '20

29 Feb '20

Hi,What is the difference between mdb_txn_commit() and mdb_txn_abort() for read-only transactions? Thank you, Samuel

2 1

With MDB Openldap seems to be pretty slower in Windows
by Vijay Kumar 28 Feb '20

28 Feb '20

Hi Team, Can you please share your inputs / suggestions on performance to increase the openldap with MDB in windows slowness.? We have a 110 users data by performance testing, where we observed slowness for windows 10 OS. If there any suggestions on tuning side, please let me know. Thank you. -- Thanks & Regards, Vijay Kumar *+91-94944 44009*

2 2

Antw: [EXT] With MDB Openldap seems to be pretty slower in Windows
by Ulrich Windl 28 Feb '20

28 Feb '20

>>> Vijay Kumar <pasumarthivijaykumar(a)gmail.com> schrieb am 28.02.2020 um 07:45 in Nachricht <15622_1582872629_5E58B835_15622_1813_1_CAKgG+3fagqROY8n5q_gpUZtzK1R10PJ+N1H=Zhx Sx0-RzgrHg(a)mail.gmail.com>: > Hi Team, > > Can you please share your inputs / suggestions on performance to increase > the openldap with MDB in windows slowness.? > > We have a 110 users data by performance testing, where we observed slowness > for windows 10 OS. Actually I'm observing Windows 10 slowness all the time even without running OpenLDAP ;-) Booting alone is about five times as long as for Windows 7 and with classical hard disks it's effectively unusable. Regards, Ulrich

1 0

Re: Cannot configure TLS
by jean-christophe manciot 27 Feb '20

27 Feb '20

I have not mentioned that my let's encrypt certificate is not SAN but wildcard. On Thu, Feb 27, 2020 at 1:10 PM jean-christophe manciot <actionmystique(a)gmail.com> wrote: > > Hi everyone, > > On Ubuntu 20.04 > slapd 2.4.49+dfsg-1ubuntu1 > with /etc/ldap/tls.ldif: > -------------------------- > dn: cn=config > changetype: modify > add: olcTLSCertificateFile > olcTLSCertificateFile: /etc/ssl/domain.crt > - > add: olcTLSCertificateKeyFile > olcTLSCertificateKeyFile: /etc/ssl/domain_priv_key.pem.decrypted > - > add: olcTLSCACertificateFile > olcTLSCACertificateFile: /etc/ssl/letsencrypt_root_intermediate_bundle.pem > > - All files are readable by openldap user. > - domain.crt is in pem format > - letsencrypt_root_intermediate_bundle.pem contains isrgrootx1.pem + > letsencryptauthorityx3.pem > -------------------------- > Yet, if I run: > ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f tls.ldif > > I get in the logs: > -------------------------- > daemon: read active on 12 > daemon: epoll: listen=8 active_threads=0 tvp=zero > daemon: epoll: listen=9 active_threads=0 tvp=zero > daemon: epoll: listen=10 active_threads=0 tvp=zero > daemon: activity on 1 descriptor > conn=1001 op=1 MOD dn="cn=config" > daemon: activity on: > conn=1001 op=1 MOD attr=olcTLSCertificateFile olcTLSCertificateKeyFile > olcTLSCACertificateFile > > => access_allowed: result not in cache (olcTLSCertificateFile) > => access_allowed: add access to "cn=config" "olcTLSCertificateFile" requested > daemon: epoll: listen=8 active_threads=0 tvp=zero > => acl_get: [1] attr olcTLSCertificateFile > daemon: epoll: listen=9 active_threads=0 tvp=zero > => acl_mask: access to entry "cn=config", attr "olcTLSCertificateFile" requested > daemon: epoll: listen=10 active_threads=0 tvp=zero > => acl_mask: to value by > "gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth", (=0) > <= check a_dn_pat: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth > <= acl_mask: [1] applying manage(=mwrscxd) (stop) > <= acl_mask: [1] mask: manage(=mwrscxd) > => slap_access_allowed: add access granted by manage(=mwrscxd) > => access_allowed: add access granted by manage(=mwrscxd) > => access_allowed: result not in cache (olcTLSCertificateKeyFile) > => access_allowed: add access to "cn=config" > "olcTLSCertificateKeyFile" requested > => acl_get: [1] attr olcTLSCertificateKeyFile > => acl_mask: access to entry "cn=config", attr > "olcTLSCertificateKeyFile" requested > => acl_mask: to value by > "gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth", (=0) > <= check a_dn_pat: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth > <= acl_mask: [1] applying manage(=mwrscxd) (stop) > <= acl_mask: [1] mask: manage(=mwrscxd) > => slap_access_allowed: add access granted by manage(=mwrscxd) > => access_allowed: add access granted by manage(=mwrscxd) > => access_allowed: result not in cache (olcTLSCACertificateFile) > => access_allowed: add access to "cn=config" "olcTLSCACertificateFile" requested > => acl_get: [1] attr olcTLSCACertificateFile > => acl_mask: access to entry "cn=config", attr > "olcTLSCACertificateFile" requested > => acl_mask: to value by > "gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth", (=0) > <= check a_dn_pat: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth > <= acl_mask: [1] applying manage(=mwrscxd) (stop) > <= acl_mask: [1] mask: manage(=mwrscxd) > => slap_access_allowed: add access granted by manage(=mwrscxd) > => access_allowed: add access granted by manage(=mwrscxd) > conn=1001 op=1 RESULT tag=103 err=80 text= > daemon: activity on 1 descriptor > daemon: activity on: > 12r > -------------------------- > > What is going on? > My logging attributes are: conns filter config acl stats stats2 shell parse > Is there a way to get more explicit logging? > - > Jean-Christophe -- Jean-Christophe

1 0

ldapsearch with DN in CN
by Möller Lioh 27 Feb '20

27 Feb '20

Hi all, I am trying to do a ldapsearch against our Active Directory LDAPS like: ldapsearch -d1 -x -LLL -D 'CN=serviceaccount,OU=spec,DC=mydomain,DC=ch' -W -H ldaps://ldap.mydomain.ch:636 -b 'OU=my-users,DC=mydomain,DC=ch' -s sub '(memberOf=CN=grp-admins,OU=my-groups,DC=mydomain,DC=ch)' The domain controllers have certificates generated with CNs like this: subject: /DC=ch/DC=mydomain/OU=Domain Controllers/CN=DC01, and a SAN defined as ldap.mydomain.ch. Yet, I got an error like: TLS: hostname (ldap.mydomain.ch) does not match common name in certificate (DC01). An interesting fact is that if the CN is set to the fqdn like dc01.mydomain.ch (not ldap.mydomain.ch), it works perfectly (with ldap.mydomain.ch as SAN). Isn't ldapsearch 2.4.44 capable of working with DN in subject (CN) or does it fail to lookup the SAN in such case? Greetings Lioh

4 4

Warnings in mdb.c generated by CodeSonar
by Christian Wendt 26 Feb '20

26 Feb '20

Dear List, I have run CodeSonar on a project using lmdb. I have downloaded lmdb-0.9.70.tar.gz. These warnings are a "Copy-Paste" error and "Use of memory after free". I would like to share the details to help find out whether these are real or false positives. The copy-paste warning is generated by code around lines 8870f in mdb.c. In the first block, csrc-> is used throughout, in the second block cdst-> is used, except in one line: /* Update the parent separators. */ if (csrc->mc_ki[csrc->mc_top] == 0) { if (csrc->mc_ki[csrc->mc_top-1] != 0) { if (IS_LEAF2(csrc->mc_pg[csrc->mc_top])) { key.mv_data = LEAF2KEY(csrc->mc_pg[csrc->mc_top], 0, key.mv_size); } else { srcnode = NODEPTR(csrc->mc_pg[csrc->mc_top], 0); key.mv_size = NODEKSZ(srcnode); key.mv_data = NODEKEY(srcnode); } DPRINTF(("update separator for source page %"Yu" to [%s]", csrc->mc_pg[csrc->mc_top]->mp_pgno, DKEY(&key))); mdb_cursor_copy(csrc, &mn); mn.mc_snum--; mn.mc_top--; /* We want mdb_rebalance to find mn when doing fixups */ WITH_CURSOR_TRACKING(mn, rc = mdb_update_key(&mn, &key)); if (rc) return rc; } if (IS_BRANCH(csrc->mc_pg[csrc->mc_top])) { MDB_val nullkey; indx_t ix = csrc->mc_ki[csrc->mc_top]; nullkey.mv_size = 0; csrc->mc_ki[csrc->mc_top] = 0; rc = mdb_update_key(csrc, &nullkey); csrc->mc_ki[csrc->mc_top] = ix; mdb_cassert(csrc, rc == MDB_SUCCESS); } } if (cdst->mc_ki[cdst->mc_top] == 0) { if (cdst->mc_ki[cdst->mc_top-1] != 0) { if (IS_LEAF2(csrc->mc_pg[csrc->mc_top])) { /* Copy-Paste Error [help] <http://codesonar.rd.skov.com:7340/install/codesonar/doc/html/CodeSonar.html…> This block of text appears to be a modified copy of the highlighted text. Did you intend to consistently change csrc to cdst, including here? */ key.mv_data = LEAF2KEY(cdst->mc_pg[cdst->mc_top], 0, key.mv_size); } else { srcnode = NODEPTR(cdst->mc_pg[cdst->mc_top], 0); key.mv_size = NODEKSZ(srcnode); key.mv_data = NODEKEY(srcnode); } DPRINTF(("update separator for destination page %"Yu" to [%s]", cdst->mc_pg[cdst->mc_top]->mp_pgno, DKEY(&key))); mdb_cursor_copy(cdst, &mn); mn.mc_snum--; mn.mc_top--; /* We want mdb_rebalance to find mn when doing fixups */ WITH_CURSOR_TRACKING(mn, rc = mdb_update_key(&mn, &key)); if (rc) return rc; } if (IS_BRANCH(cdst->mc_pg[cdst->mc_top])) { MDB_val nullkey; indx_t ix = cdst->mc_ki[cdst->mc_top]; nullkey.mv_size = 0; cdst->mc_ki[cdst->mc_top] = 0; rc = mdb_update_key(cdst, &nullkey); cdst->mc_ki[cdst->mc_top] = ix; mdb_cassert(cdst, rc == MDB_SUCCESS); } } The second error is triggered by the loop freeing loose pages at line 3451 in mdb.c: NEXT_LOOSE_PAGE(mp) would access memory that is freed before, if mp points to an overflow page with more than one page allocated. If this is never the case, then maybe mdb_page_free() should be called on mp directly? for (; mp; mp = NEXT_LOOSE_PAGE(mp)) { /* Use After Free [help] <http://codesonar.rd.skov.com:7340/install/codesonar/doc/html/CodeSonar.html…> The memory pointed to by mp was freed at mdb.c:2047 and is read from here. */ mdb_midl_xappend(txn->mt_free_pgs, mp->mp_pgno); /* must also remove from dirty list */ if (txn->mt_flags & MDB_TXN_WRITEMAP) { for (x=1; x<=dl[0].mid; x++) if (dl[x].mid == mp->mp_pgno) break; mdb_tassert(txn, x <= dl[0].mid); } else { x = mdb_mid2l_search(dl, mp->mp_pgno); mdb_tassert(txn, dl[x].mid == mp->mp_pgno); } dl[x].mptr = NULL; mdb_dpage_free(env, mp); mdb_dpage_free(MDB_env *env, MDB_page *dp) { if (!IS_OVERFLOW(dp) || dp->mp_pages == 1) { mdb_page_free(env, dp); } else { /* large pages just get freed directly */ VGMEMP_FREE(env, dp); free(dp); } } I hope you can follow these descriptions, I can provide more detail if needed. I would like to get some help figuring out how to resolve these warnings. Best regards, Christian Wendt Software developer Ext: +45 7217 5943 ______________________________________ SKOV A/S Hedelund 4, Glyngoere, 7870 Roslev, Denmark Tel.: +45 7217 5555 - Fax: +45 7217 5959 www.skov.com<http://www.skov.com/>

2 3

How to simulate slow queries?
by Andrey Brindeyev 24 Feb '20

24 Feb '20

Hello! I'm trying to debug a specific issue that is related to slow queries, so I need a way how to simulate slow LDAP server responses. It will be optimal if I can set a specific number of seconds per query shape, but a general (configured) delay is fine too. I've already tried the retcode overlay, and I think it only simulates the slow bind scenarios and not the slow query responses. Here's an excerpt from my slapd.conf: overlay retcode retcode-parent "ou=Users,dc=acme,dc=qa" #retcode-item "uid=mdb" 0x00 retcode-item "uid=mdb" 0x00 sleeptime=4 retcode-item "cn=user1" 0x00 retcode-item "cn=user2" 0x00 retcode-item "cn=user3" 0x00 retcode-item "cn=user4" 0x00 retcode-item "cn=user5" 0x00 If there's no way this can be configured using existing options in OpenLDAP, I appreciate advice wherein the source code I need to insert the sleep construct. Ideally, it should work with the retcode overlay, so that I can test the slow bind scenarios and slow query responses at the same time. Thanks, Andrey.

1 0

SSH groups
by Клеусов Владимир Сергеевич 19 Feb '20

19 Feb '20

Hi, I connected ldap linux clients to the OpenLDAP server. I need to make a certain group of users able to connect to certain computers. How do I do this ?

5 5

Critical Issue : Openldap Slave Performance Issue of high recq
by keerthi krishnan 19 Feb '20

19 Feb '20

Hi , We have environment of multi-master and slave replication . master1 < =====> master 2 | | | | Slave 1 Slave 1 & & slave 2 slave 2 Now we are facing issue in all slaves, where replication from master is very slow. All slaves are single threaded. We are seeing High RECQ and sometimes server goes unavailable, untill we restart the slapd service. tcp 757967 0 ****:36340 <http://10.8.234.141:36340/> *****:636 <http://10.8.241.41:636/> ESTABLISHED 22160/slapd Could someone tell me, what kind of tuning we can perform?. If we make multi threaded, it will not have much performance. Kindly help .. Production servers are having this issue. Other system configuration like (Memory, load, disk) everything looks okay. I checked this kernel parameters as well. net.core.rmem_max = 4194304 net.ipv4.tcp_rmem = 4096 65536 4194304 Regards K.Keerthiga

2 1

Re: Urgent: New User with context CSN permission
by keerthi krishnan 16 Feb '20

16 Feb '20

hi Quanah, Thanks for guiding me. I have figured it out. It is working now. On Sun, 16 Feb 2020 at 01:22, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Saturday, February 15, 2020 9:21 PM +0530 keerthi krishnan > <keerthikrishnan1369(a)gmail.com> wrote: > > > Hi Quanah, > > > Now the user replmonitor has admin privilege, where it can list all cn > > ,. I have tried adding attrs=contextcsn , but no luck. Could you please > > guide me, how can i restrict this. > > contextcsn is an internally managed operational attribute, which means you > need to explicilty request it as a part of your search operation, or > request that all operational attrs be returned. How are you testing > whether or not the bind DN has the ability to read the attribute? > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Re: Urgent: New User with context CSN permission
by keerthi krishnan 16 Feb '20

16 Feb '20

Hi Quanah, Let me explain in detail. Now I can search the entire OU and contextCSN as below . I am searching with bind dn. ++ olcAccess: {1}to dn.subtree="dc=ldapprod,dc=com" by dn="cn=a dmin,dc=ldapprod,dc=com" write by dn="uid=authuser, dc=ldapprod,dc=com" write by dn="uid=repluser, dc=ldapprod,dc=com" read by dn="uid=replmonitor, dc=ldapprod,dc=com" read by * none ++ ldapsearch -x -H ldaps://IP address -D "uid=replmonitor,dc=ldapprod,dc=com" -W -b "dc=ldapprod,dc=com" contextCSN +++++ # ldapprod.com dn: dc=ldapprod,dc=com contextCSN: 20200212065804.242207Z#000000#000#000000 contextCSN: 20200213163933.076777Z#000000#001#000000 # admin, ldapprod.com dn: cn=admin,dc=ldapprod,dc=com # group, ldapprod.com dn: ou=group,dc=ldapprod,dc=com # people, ldapprod.com dn: ou=people,dc=ldapprod,dc=com # repluser, ldapprod.com dn: uid=repluser,dc=ldapprod,dc=com # authuser, ldapprod.com dn: uid=authuser,dc=ldapprod,dc=com # monitor, ldapprod.com dn: cn=monitor,dc=ldapprod,dc=com # replmonitor, ldapprod.com dn: uid=replmonitor,dc=ldapprod,dc=com +++++ Now replmonitor, got full access like admin where it can do all operation like cn=admin user. Now I want to restrict the user replmonitor only it can search and query contextcsn attr not any other dn. How can i achieve this?. Kindly guide me. On Sun, 16 Feb 2020 at 01:22, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Saturday, February 15, 2020 9:21 PM +0530 keerthi krishnan > <keerthikrishnan1369(a)gmail.com> wrote: > > > Hi Quanah, > > > Now the user replmonitor has admin privilege, where it can list all cn > > ,. I have tried adding attrs=contextcsn , but no luck. Could you please > > guide me, how can i restrict this. > > contextcsn is an internally managed operational attribute, which means you > need to explicilty request it as a part of your search operation, or > request that all operational attrs be returned. How are you testing > whether or not the bind DN has the ability to read the attribute? > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Re: Urgent: New User with context CSN permission
by keerthi krishnan 15 Feb '20

15 Feb '20

> > Hi Quanah, > > Thanks for the clarification. > > I have added as below > > +++ > olcAccess: {1}to dn.subtree="dc=ldapprod,dc=com" by dn="cn=a > dmin,dc=ldapprod,dc=com" write by dn="uid=authuser, > dc=ldapprod,dc=com" write by dn="uid=repluser, > dc=ldapprod,dc=com" read by dn="uid=replmonitor, > dc=ldapprod,dc=com" read by * none > +++ > > Now the user replmonitor has admin privilege, where it can list all cn ,. > I have tried adding attrs=contextcsn , but no luck. Could you please guide > me, how can i restrict this. > > Regards > K.Keerthiga > > > > On Fri, 14 Feb 2020 at 09:12, Quanah Gibson-Mount <quanah(a)symas.com> > wrote: > >> >> >> --On Friday, February 14, 2020 8:03 AM +0530 keerthi krishnan >> <keerthikrishnan1369(a)gmail.com> wrote: >> >> >> > olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by >> > anonym >> > >> > ous auth by dn="cn=admin,dc=ldapprod,dc=com" write by dn="u >> > >> > id=authuser,dc=ldapprod,dc=com" write by dn="uid=repluser,d >> > >> > c=ldapprod,dc=com" read by * none >> > >> > olcAccess: {1}to dn.subtree="dc=ldappro,dc=com" by dn="cn=a >> > >> > dmin,dc=ldapprod,dc=com" write by dn="uid=authuser,dc=ldapprod,dc=com" >> > write by >> > >> > dn="uid=repluser,dc=ldapprod,dc=com" read by * none >> > >> > olcAccess: {2} to dn.subtree="dc=ldapprod,dc=com" attrs=contextCSN by >> > dn="uid=replmonitor,dc=ldapprod,dc=com" read by * none >> > =======> newly added >> >> Hi, >> >> As documented in the slapd.access(5) man page, ACL processing stops on >> the >> first matching rule. Since rule {1} covers access to all attributes >> except >> userPassword, your query for contextCSN matches rule {1} and rule {2} >> never >> fires. >> >> You probably want to move access rule {2} to be in front of {1}, and add >> additional "by" clauses to the rule to allow the admin, authuser, and >> repluser access to the attr. >> >> Regards, >> Quanah >> >> >> -- >> >> Quanah Gibson-Mount >> Product Architect >> Symas Corporation >> Packaged, certified, and supported LDAP solutions powered by OpenLDAP: >> <http://www.symas.com> > >

2 1

syncrepl syncing but not updating, contextCNS missing and schemacheck off
by jehan.procaccia＠imtbs-tsp.eu 15 Feb '20

15 Feb '20

Hello my syncrepl consumer does get initial synchronisation, but then is never updated I struggled a lot , to finally discover that contextCNS is not created on that replica, that might explain why it is not updated after initial sync . after different "try and catch" (ACLs, checpoint values etc ...) I finally discovered that setting schemachecking to *Off* (cf full syncrepl config below) on the consumer syncrepl config corrected the pb, contextCNS is then finally created after inital sync (after few dozen of seconds ...) and subsequent updated on master does get replicated on consumer. Shemas a stricly the same on provider (master) end consumer (replica) what would explain that schemachecking directive to break syncrepl contextCNS to be created ? is it wrong to run replicas with schemacheck Off ? maybe related , but no real solution to me : https://stackoverflow.com/questions/6525984/syncrepl-syncing-but-not-updati… regards syncrepl rid=081 provider=ldaps://master.int.fr type=refreshAndPersist searchbase="dc=int,dc=fr" filter="(objectClass=*)" attrs="*,+" scope=sub schemachecking=*off* bindmethod=simple retry="60 10 300 +" binddn="cn=rep,ou=dsa,dc=int,dc=fr" credentials="secret" updateref ldaps://master.int.fr:636

3 6

LDAPS and ssh public key
by Клеусов Владимир Сергеевич 14 Feb '20

14 Feb '20

Hi I use ldaps . Will I be able to set up authentication using the SSH public key ? I use LDAP account Manager (https://www.ldap-account-manager.org/lamcms/) Here https://www.ldap-account-manager.org/static/doc/manual/ch04s02.html now You can manage your public keys for SSH in Lam if you have installed the LPK patch for SSH or configured AUTHORIZEDKEYSCOMMAND& What does OR mean ? Google says that i need to download the scheme for SSH keys and add the script to AUTHORIZEDKEYSCOMMAND. But in https://code.google.com/archive/p/openssh-lpk/wikis/Main.wiki written To use lpk you must either use standard ldap (not recommended) or LDAP + TLS. ldaps:// URLs will not work. So in the end ssh key +LDAPS will not work ? Or is there a way to use ssh key +LDAPS ?

2 1

Re: Urgent: New User with context CSN permission
by keerthi krishnan 14 Feb '20

14 Feb '20

Hi Quanah, Thanks for your reply. Please find the requirements and permission ++++++++++++++++++++ We have setup of master and slave replication, where we have two users admin(default), authuser and repluser for replication which has full admin privilege. I am trying to create a new user “replmonitor” which I want to give access only to attribute contextCSN . Replmonitor user ++++ # replmonitor, ldapprod.com dn: uid=replmonitor,dc=ldapprod,dc=com objectClass: simpleSecurityObject objectClass: account uid: replmonitor description: LDAP rreplication monitor userPassword:: ###################### ++++ This is the complete olcaccess for the users in olcDatabase={3}mdb. ++ olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonym ous auth by dn="cn=admin,dc=ldapprod,dc=com" write by dn="u id=authuser,dc=ldapprod,dc=com" write by dn="uid=repluser,d c=ldapprod,dc=com" read by * none olcAccess: {1}to dn.subtree="dc=ldappro,dc=com" by dn="cn=a dmin,dc=ldapprod,dc=com" write by dn="uid=authuser,dc=ldapprod,dc=com" write by dn="uid=repluser,dc=ldapprod,dc=com" read by * none olcAccess: {2} to dn.subtree="dc=ldapprod,dc=com" attrs=contextCSN by dn="uid=replmonitor,dc=ldapprod,dc=com" read by * none =======> newly added olcLimits: {0}dn.exact="uid=repluser,dc=ldapprod,dc=com" tim e.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimite d olcLimits: {1}dn.exact="uid=authuser,dc=ldapprod,dc=com" tim e.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimite d olcSecurity: tls=1 ++ ++++++++++++++++++ [root@devldap cn=config]# ldapsearch -x -H ldaps://10.0.0.1 -D "uid=replmonitor,dc=ldapprod,dc=com" -W -b "ldapprod,dc=com" contextCSN Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=ldapprod,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object Please help me, what I am missing here that I am not able to query the ContextCSN . Got struck for a complete day. On Fri, 14 Feb 2020 at 03:21, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Thursday, February 13, 2020 5:50 PM +0530 keerthi krishnan > <keerthikrishnan1369(a)gmail.com> wrote: > > > > > access to dn.base="dc=domain,dc=com" attrs=entry,children,contextcsn by > > dn.exact="uid=replmonitor,dc=domain,dc=com" read by * none > > Access statements without the context of the full configuration provide no > real information that can be acted upon the majority of the time. I would > also note that "by * none" at the end of an ACL is implicit, as discussed > in the slapd.access(5) man page, so there is no reason to explicitly list > it. > > If you want help with your ACLs, you need to provide your configuration > (minus passwords). > > Regards, > Quanah > > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

Urgent: New User with context CSN permission
by keerthi krishnan 13 Feb '20

13 Feb '20

Hi Team, Requirements: I want to create user and provide only access to contextCSN. I have tried to create user and gave privilege as below. access to dn.base="dc=domain,dc=com" attrs=entry,children,contextcsn by dn.exact="uid=replmonitor,dc=domain,dc=com" read by * none But it results as ldapsearch -x -H ldaps:// -D "uid=replmonitor,dc=domain,dc=com" -W -b "dc=domain,dc=com" Enter LDAP Password: search: 2 result: 32 No such object Please someone help me with the acl for the new user where it can list the contextCSN Regards K.Keerthiga

3 3

proxy ldap (back_ldap) with group ACL?
by brent s. 13 Feb '20

13 Feb '20

Hey, all! First, a BIG thank you to both JoBbZ and tarpman in #openldap, they've got me this far (p.s. JoBbZ- switched over to the symas packages for my test env, replacement was more or less seamless. need to schedule some downtime for prod, but thanks for passing that along!) However, I'm not at a standstill. I'm using the OLC config (...I guess that's like saying "PIN number"). I have two servers, foo.domain.tld and bar.domain.tld. foo.domain.tld has DSA of dc=domain,dc=com and bar.domain.tld has a DSA of dc=domain,dc=net. I can successfully auth as e.g. cn=username,dc=domain,dc=net to foo.domain.tld using the following configuration (at olcDatabase={3}ldap,cn=config): dn: olcDatabase={3}ldap,cn=config objectClass: olcLDAPConfig objectClass: olcDatabaseConfig olcDatabase: {3}ldap olcDbIDAssertAuthzFrom: {0}"dn:*" olcDbIDAssertBind: mode=self olcDbRebindAsUser: TRUE olcDbSessionTrackingRequest: TRUE olcDbStartTLS: start olcDbURI: ldap://bar.domain.tld olcReadOnly: TRUE olcSuffix: dc=domain,dc=net However, when I attempt to e.g. implement the following ACL on foo.domain.tld: {2}to dn.exact="ou=groupname,dc=domain,dc=com" attrs=children (...) by group.exact="cn=GroupAdmins,dc=domain,dc=net" manage by * none I get the error: Feb 08 00:32:19 foo slapd[17600]: => acl_mask: access to entry "ou=groupname,dc=domain,dc=com", attr "entry" requested Feb 08 00:32:19 foo slapd[17600]: => acl_mask: to all values by "cn=username,dc=domain,dc=net", (=0) Feb 08 00:32:19 foo slapd[17600]: <= check a_group_pat: cn=groupadmins,ou=groups,dc=domain,dc=net Feb 08 00:32:19 foo slapd[17600]: =>ldap_back_getconn: conn 0x7f7700009ef0 fetched refcnt=1. Feb 08 00:32:19 foo slapd[17600]: Error: ldap_back_is_proxy_authz returned 0, misconfigured URI? (it is a given that cn=username,dc=domain,dc=net is indeed a member ("member" attribute) of the groupOfNames object cn=GroupAdmins,dc=domain,dc=net and additionally, the cn=username,dc=domain,dc=net object has the "memberOf" attribute "cn=GroupAdmins,dc=domain,dc=net") I'm fairly certain this is PEBKAC, but I'm unclear what's going on. Do I need to reference the group in the ACL explicitly with the LDAP URI prefixed or something? -- brent saner https://square-r00t.net/ GPG info: https://square-r00t.net/gpg-info

1 2

Antw: [EXT] Re: Q: "5e43b796 PROXIED attributeDescription "DC" inserted."
by Ulrich Windl 13 Feb '20

13 Feb '20

>>> Quanah Gibson-Mount <quanah(a)symas.com> schrieb am 12.02.2020 um 23:53 in Nachricht <28602_1581548017_5E4481F1_28602_870_1_DDCC864DABD8E91E4DE841F1(a)[192.168.1.144]> > > ‑‑On Wednesday, February 12, 2020 9:33 AM +0100 Ulrich Windl > <Ulrich.Windl(a)rz.xn--uniregensburg-dm6g.de> wrote: > >> Hi! >> >> While trying to slapadd a dumped config database in "‑u" mode, I see this: >> 5e43b796 PROXIED attributeDescription "DC" inserted. >> >> What does it mean? There is no "DC" in the LDIF file being imported. > > It has to do with attributes existing in cn=config (such as modifiersName > or creatorsName usually) where the DN that modified the entry has a "dc" > component. You can safely ignore it. This is one of the reasons I'm not > fond of the default way in which Debian/Ubuntu/RH (mis)configured their > default access setup for cn=config. Thanks a lot! First I only had been searching it in upper case, but it's there in lower case at various places: olcAccess, olcLimits, olcSuffix, olcRootDN, olcPPolicyDefault. Also as database #0 was the first one to import, those dc= names were missing at that point in time. That would explain the message. However the message by itself is of little usefulness: The only context is 5e43b796, and it's hard to relate that to some object or line in LDIF... Regards, Ulrich > > Regards, > Quanah > > > > ‑‑ > > Quanah Gibson‑Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com>

1 0

Q: "5e43b796 PROXIED attributeDescription "DC" inserted."
by Ulrich Windl 12 Feb '20

12 Feb '20

Hi! While trying to slapadd a dumped config database in "-u" mode, I see this: 5e43b796 PROXIED attributeDescription "DC" inserted. What does it mean? There is no "DC" in the LDIF file being imported. Regards, Ulrich

2 1

compilation error on 2.4.49
by nicolas renault 12 Feb '20

12 Feb '20

Hello, on openSUSE leap 42.2 from source ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/openldap-2.4.49.tgz ./configure --enable-ipv6=no --enable-dynamic=yes --enable-debug=no --enable-modules=yes --enable-slapd --enable-modules --enable-overlays=mod --enable-mdb=yes --enable-meta=yes --enable-monitor=yes --enable-ldap=yes --enable-hdb=no --enable-bdb=no => no error make depend => no error make => lot of line and during actions these line : -------------------------- ...cd overlays; make -w static make[3]: Entering directory '/root/openldap_compilation/openldap-2.4.49/servers/slapd/overlays' cc -g -O2 -I../../../include -I../../../include -I.. -I./.. -c -o statover.o statover.c cc -g -O2 -I../../../include -I../../../include -I.. -I./.. -c -o overlays.o overlays.c rm -f version.c ../../../build/mkversion -v "2.4.49" ../liboverlays.a > version.c /bin/sh ../../../libtool --tag=disable-static --mode=compile cc -g -O2 -I../../../include -I../../../include -I.. -I./.. -DSLAPD_IMPORT -c version.c mkdir .libs cc -g -O2 -I../../../include -I../../../include -I.. -I./.. -DSLAPD_IMPORT -c version.c -fPIC -DPIC -o .libs/version.o ar rs ../liboverlays.a statover.o overlays.o ar: creating ../liboverlays.a make[3]: Leaving directory '/root/openldap_compilation/openldap-2.4.49/servers/slapd/overlays' ../../build/mkversion -v "2.4.49" -s -n Versionstr slapd > version.c cc -g -O2 -I../../include -I. -I./slapi -I. -I../../include -c -o main.o main.c cc -g -O2 -I../../include -I. -I./slapi -I. -I../../include -c -o globals.o globals.c cc -g -O2 -I../../include -I. -I./slapi -I. -I../../include -c -o bconfig.o bconfig.c bconfig.c: In function ‘config_rename_one’:bconfig.c:4496:2: warning: passing argument 3 of ‘ldap_bv2rdn’ from incompatible pointer type [enabled by default] rc = ldap_bv2rdn( &e->e_name, &rDN, &text, LDAP_DN_FORMAT_LDAP ); ^ In file included from slap.h:51:0, from bconfig.c:30: ../../include/ldap.h:1709:1: note: expected ‘char **’ but argument is of type ‘const char **’ ldap_bv2rdn LDAP_P(( ^ bconfig.c: In function ‘config_build_entry’: bconfig.c:6514:2: warning: passing argument 3 of ‘ldap_bv2rdn’ from incompatible pointer type [enabled by default] rc = ldap_bv2rdn( rdn, &rDN, &text, LDAP_DN_FORMAT_LDAP ); ^ In file included from slap.h:51:0, from bconfig.c:30: ../../include/ldap.h:1709:1: note: expected ‘char **’ but argument is of type ‘const char **’ ldap_bv2rdn LDAP_P(( ^ cc -g -O2 -I../../include -I. -I./slapi -I. -I../../include -c -o config.o config.ccc -g -O2 -I../../include -I. -I./slapi -I. -I../../include -c -o daemon.o daemon.c cc -g -O2 -I../../include -I. -I./slapi -I. -I../../include -c -o connection.o connection.c cc -g -O2 -I../../include -I. -I./slapi -I. -I../../include -c -o search.o search.c cc -g -O2 -I../../include -I. -I./slapi -I. -I../../include -c -o filter.o filter.c cc -g -O2 -I../../include -I. -I./slapi -I. -I../../include -c -o add.o add.c cc -g -O2 -I../../include -I. -I./slapi -I. -I../../include -c -o cr.o cr.c....-------------------------- ad also on compilation/building of autogroup -------------------------- openldap-2.4.49/contrib/slapd-modules/autogroup # make ../../../libtool --mode=compile gcc -g -O2 -Wall -I../../../include -I../../../include -I../../../servers/slapd -c autogroup.cmkdir .libs gcc -g -O2 -Wall -I../../../include -I../../../include -I../../../servers/slapd -c autogroup.c -fPIC -DPIC -o .libs/autogroup.o autogroup.c: In function ‘autogroup_delete_entry’: autogroup.c:963:27: warning: variable ‘age_prev’ set but not used [-Wunused-but-set-variable] autogroup_entry_t *age, *age_prev, *age_next; ^ autogroup.c: In function ‘ag_cfgen’: autogroup.c:1940:5: warning: too many arguments for format [-Wformat-extra-args] c->argv[ 2 ] ); ^ autogroup.c:1940:5: warning: too many arguments for format [-Wformat-extra-args] gcc -g -O2 -Wall -I../../../include -I../../../include -I../../../servers/slapd -c autogroup.c -o autogroup.o >/dev/null 2>&1 ../../../libtool --mode=link gcc -g -O2 -Wall -version-info 0:0:0 \ -rpath /usr/local/libexec/openldap -module -o autogroup.la autogroup.lo ../../../libraries/libldap_r/libldap_r.la ../../../libraries/liblber/liblber.la cc -shared .libs/autogroup.o -Wl,--rpath -Wl,/root/openldap_compilation/openldap-2.4.49/libraries/libldap_r/.libs -Wl,--rpath -Wl,/root/openldap_compilation/openldap-2.4.49/libraries/liblber/.libs -L/root/openldap_compilation/openldap-2.4.49/libraries/liblber/.libs ../../../libraries/libldap_r/.libs/libldap_r.so ../../../libraries/liblber/.libs/liblber.so -Wl,-soname -Wl,autogroup.so.0 -o .libs/autogroup.so.0.0.0 (cd .libs && rm -f autogroup.so.0 && ln -s autogroup.so.0.0.0 autogroup.so.0) (cd .libs && rm -f autogroup.so && ln -s autogroup.so.0.0.0 autogroup.so) ar cru .libs/autogroup.a autogroup.o ranlib .libs/autogroup.a creating autogroup.la (cd .libs && rm -f autogroup.la && ln -s ../autogroup.la autogroup.la) -------------------------- How can I solve these errors ? does I make something wrong in my process ? thanks in advance for your reply . Nicolas

2 2

Re: Openldap support SHA-256 or SHA-3.
by Quanah Gibson-Mount 11 Feb '20

11 Feb '20

--On Monday, February 10, 2020 3:39 PM -0800 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > When will 2.5 release will be out? When it's ready. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

ldapuri vs. ldaphost
by Dieter Klünter 09 Feb '20

09 Feb '20

Hi, The manual pages ldapsearch(1) et.al. describe ldapuri abbriviation as -H and ldaphost abbriviation -h. Both, ldapuri and ldpaphost description might be of host name or host ip. If ldapuri is a ipv6 address, an error occurs: Could not parse LDAP URI(s)=2001:16b8:c115:9f00:44ff:f15b:11d1:e620 (3 ldapsearch -YGSSAPI -H 2001:16b8:c115:9f00:44ff:f15b:11d1:e620 -b "" -s base +. Just for verification one may use ipv6 address ::1 The question is: must ldapuri contain a hostname, or would a hostaddress be sufficient. While ldaphost accepts hostname and hostaddress? -Dieter -- Dieter Klünter | Systemberatung http://sys4.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

3 4

saslauthd permission denied
by Joshua Schaeffer 08 Feb '20

08 Feb '20

I'm having a difficult time setting up pass-through authentication. I've set it up before but can't seem to get it to work this time. I've done the following: - Created the slapd.conf for SASL. - Started and ensured saslauthd is running. - Added the openldap user to the sasl group. - Verified with testsaslauthd that SASL is working - Restarted slapd and the server just to make sure all settings/permissions are updated properly However I always get a permission denied error message when slapd tries to contact saslauthd: Feb 5 12:13:56 bllldap01 slapd[477]: SASL [conn=2866] Failure: cannot connect to saslauthd server: Permission denied I've even temporarily enabled the shell on the openldap user and tested testsaslauthd which returned a successful result. I feel like I'm missing something obvious and maybe a fresh set of eyes can point that out. Below is all the relevant details of my system: ######################## # SASL & LDAP SETTINGS # ######################## jschaeffer@bllldap01:~$ ls -l /etc/ldap/sasl2/slapd.conf -rw-r--r-- 1 root root 65 Feb 5 12:45 /etc/ldap/sasl2/slapd.conf jschaeffer@bllldap01:~$ cat /etc/ldap/sasl2/slapd.conf pwcheck_method: saslauthd saslauthd_path: /var/run/saslauthd/mux jschaeffer@bllldap01:~$ groups openldap openldap : openldap sasl ssl-cert jschaeffer@bllldap01:~$ ls -ld /var/run/saslauthd/ drwx--x--- 2 root sasl 140 Feb 5 12:16 /var/run/saslauthd/ jschaeffer@bllldap01:~$ sudo ls -l /var/run/saslauthd/ total 968 -rw------- 1 root root 0 Feb 5 12:16 cache.flock -rw------- 1 root root 986112 Feb 5 12:16 cache.mmap srwxrwxrwx 1 root root 0 Feb 5 12:16 mux -rw------- 1 root root 0 Feb 5 12:16 mux.accept -rw------- 1 root root 4 Feb 5 12:16 saslauthd.pid jschaeffer@bllldap01:~$ cat /etc/default/saslauthd | grep -E -v '(#|^$)' START=yes DESC="SASL Authentication Daemon" NAME="saslauthd" MECHANISMS="kerberos5" MECH_OPTIONS="" THREADS=5 OPTIONS="-c -m /var/run/saslauthd" export KRB5_KTNAME=/etc/krb5.keytab jschaeffer@bllldap01:~$ ps aux | grep [s]asl root 472 0.0 0.0 100980 2956 ? Ss 12:16 0:00 /usr/sbin/saslauthd -a kerberos5 -c -m /var/run/saslauthd -n 5 root 473 0.0 0.0 109392 6516 ? S 12:16 0:00 /usr/sbin/saslauthd -a kerberos5 -c -m /var/run/saslauthd -n 5 root 474 0.0 0.0 100980 1056 ? S 12:16 0:00 /usr/sbin/saslauthd -a kerberos5 -c -m /var/run/saslauthd -n 5 root 475 0.0 0.0 100980 1056 ? S 12:16 0:00 /usr/sbin/saslauthd -a kerberos5 -c -m /var/run/saslauthd -n 5 root 476 0.0 0.0 100980 1056 ? S 12:16 0:00 /usr/sbin/saslauthd -a kerberos5 -c -m /var/run/saslauthd -n 5 jschaeffer@bllldap01:~$ ps aux | grep [s]lapd openldap 1236 0.0 4.7 2344672 737116 ? Ssl 13:19 0:00 /usr/sbin/slapd -h ldap:/// ldaps:/// ldapi:/// -g openldap -u openldap -F /etc/ldap/slapd.d jschaeffer@bllldap01:~$ sudo testsaslauthd -u jschaeffer(a)HARMONYWAVE.CLOUD -p ************ 0: OK "Success." jschaeffer@bllldap01:~$ cat /etc/passwd | grep 'openldap' openldap:x:111:115:OpenLDAP Server Account,,,:/var/lib/ldap:/bin/bash jschaeffer@bllldap01:~$ sudo su - openldap openldap@bllldap01:~$ testsaslauthd -u jschaeffer(a)HARMONYWAVE.CLOUD -p ************ 0: OK "Success." ################ # DEBUG OUTPUT # ################ Feb 5 12:13:53 bllldap01 slapd[477]: conn=2866 fd=40 ACCEPT from IP=[fd83:172:16:44::1000]:44920 (IP=[::]:389) Feb 5 12:13:53 bllldap01 slapd[477]: conn=2866 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Feb 5 12:13:53 bllldap01 slapd[477]: conn=2866 op=0 STARTTLS Feb 5 12:13:53 bllldap01 slapd[477]: conn=2866 op=0 RESULT oid= err=0 text= Feb 5 12:13:53 bllldap01 slapd[477]: conn=2866 fd=40 TLS established tls_ssf=256 ssf=256 Feb 5 12:13:55 bllldap01 slapd[477]: conn=2846 op=69 SRCH base="ou=People,dc=harmonywave,dc=cloud" scope=2 deref=0 filter="(&(uid=radiomail)(objectClass$ Feb 5 12:13:55 bllldap01 slapd[477]: conn=2846 op=69 SRCH attr=objectClass uid userPassword uidNumber gidNumber gecos homeDirectory loginShell krbPrinci$ Feb 5 12:13:55 bllldap01 slapd[477]: conn=2846 op=69 SEARCH RESULT tag=101 err=0 nentries=0 text= Feb 5 12:13:55 bllldap01 slapd[477]: conn=2787 op=637 SRCH base="cn=HARMONYWAVE.CLOUD,cn=krbContainer,dc=harmonywave,dc=cloud" scope=2 deref=0 filter="($ Feb 5 12:13:55 bllldap01 slapd[477]: conn=2787 op=637 SRCH attr=krbprincipalname krbcanonicalname objectclass krbprincipalkey krbmaxrenewableage krbmaxt$ Feb 5 12:13:55 bllldap01 slapd[477]: conn=2787 op=637 SEARCH RESULT tag=101 err=0 nentries=0 text= Feb 5 12:13:55 bllldap01 slapd[477]: conn=2846 op=70 SRCH base="ou=People,dc=harmonywave,dc=cloud" scope=2 deref=0 filter="(&(uid=radiomail)(objectClass$ Feb 5 12:13:55 bllldap01 slapd[477]: conn=2846 op=70 SRCH attr=objectClass uid userPassword uidNumber gidNumber gecos homeDirectory loginShell krbPrinci$ Feb 5 12:13:55 bllldap01 slapd[477]: conn=2846 op=70 SEARCH RESULT tag=101 err=0 nentries=0 text= Feb 5 12:13:56 bllldap01 slapd[477]: conn=2866 op=1 BIND dn="uid=jschaeffer,ou=End Users,ou=People,dc=harmonywave,dc=cloud" method=128 Feb 5 12:13:56 bllldap01 slapd[477]: SASL [conn=2866] Failure: cannot connect to saslauthd server: Permission denied Feb 5 12:13:56 bllldap01 slapd[477]: conn=2866 op=1 RESULT tag=97 err=49 text= Feb 5 12:13:56 bllldap01 slapd[477]: conn=2866 op=2 UNBIND Feb 5 12:13:56 bllldap01 slapd[477]: conn=2866 fd=40 closed jschaeffer@bllldap01:~$ sudo strace -f -p 1236 ... [{EPOLLIN, {u32=1975476364, u64=140507535597708}}], 1048576, 1409000) = 1 [pid 1237] epoll_ctl(7, EPOLL_CTL_MOD, 31, {0, {u32=1975476364, u64=140507535597708}}) = 0 [pid 1237] futex(0x5567c5bf4978, FUTEX_WAKE_PRIVATE, 1) = 1 [pid 1237] epoll_wait(7, <unfinished ...> [pid 1265] <... futex resumed> ) = 0 [pid 1265] futex(0x5567c5bf4928, FUTEX_WAKE_PRIVATE, 1) = 0 [pid 1265] read(31, "\27\3\3\0m", 5) = 5 [pid 1265] read(31, "\0\0\0\0\0\0\0\1*\215C]\226R#c(\250!j\255\254r\226'|\226y\0365\334\231"..., 109) = 109 [pid 1265] read(31, 0x7fc9f015e053, 5) = -1 EAGAIN (Resource temporarily unavailable) [pid 1265] epoll_ctl(7, EPOLL_CTL_MOD, 31, {EPOLLIN, {u32=1975476364, u64=140507535597708}}) = 0 [pid 1265] write(6, "0", 1) = 1 [pid 1237] <... epoll_wait resumed> [{EPOLLIN, {u32=1975476260, u64=140507535597604}}], 1048576, 1402000) = 1 [pid 1265] getpid( <unfinished ...> [pid 1237] read(5, <unfinished ...> [pid 1265] <... getpid resumed> ) = 1236 [pid 1237] <... read resumed> "0", 8192) = 1 [pid 1265] sendto(4, "<167>Feb 5 13:26:30 slapd[1236]"..., 132, MSG_NOSIGNAL, NULL, 0 <unfinished ...> [pid 1237] epoll_wait(7, <unfinished ...> [pid 1265] <... sendto resumed> ) = 132 [pid 1265] socket(AF_UNIX, SOCK_STREAM, 0) = 32 [pid 1265] connect(32, {sa_family=AF_UNIX, sun_path="/var/run/saslauthd/mux"}, 110) = -1 EACCES (Permission denied) [pid 1265] close(32) = 0 [pid 1265] getpid() = 1236 [pid 1265] sendto(4, "<167>Feb 5 13:26:30 slapd[1236]"..., 114, MSG_NOSIGNAL, NULL, 0) = 114 [pid 1265] write(31, "\27\3\3\0&\0\0\0\0\0\0\0\1\270\22\25\347\316\323\6\3721\375\200{\300\350\337E\371\221\206"..., 43) = 43 [pid 1265] getpid() = 1236 [pid 1265] sendto(4, "<167>Feb 5 13:26:30 slapd[1236]"..., 76, MSG_NOSIGNAL, NULL, 0) = 76 [pid 1265] futex(0x5567c5bf497c, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...> [pid 1237] <... epoll_wait resumed> [{EPOLLIN, {u32=1975476364, u64=140507535597708}}], 1048576, 1402000) = 1 [pid 1237] epoll_ctl(7, EPOLL_CTL_MOD, 31, {0, {u32=1975476364, u64=140507535597708}}) = 0 [pid 1237] futex(0x5567c5bf4978, FUTEX_WAKE_PRIVATE, 1) = 1 [pid 1237] epoll_wait(7, <unfinished ...> [pid 1238] <... futex resumed> ) = 0 [pid 1238] futex(0x5567c5bf4928, FUTEX_WAKE_PRIVATE, 1) = 0 [pid 1238] read(31, "\27\3\3\0\37", 5) = 5 [pid 1238] read(31, "\0\0\0\0\0\0\0\2L6Z\337[:\364z\331\361\277\350\31\33\354\316\20IP\375EI\0", 31) = 31 [pid 1238] read(31, "\25\3\3\0\32", 5) = 5 [pid 1238] read(31, "\0\0\0\0\0\0\0\3z\277}k\22\1775dS)BR\377\344\277\271\323\221", 26) = 26 [pid 1238] write(6, "0", 1) = 1 [pid 1237] <... epoll_wait resumed> [{EPOLLIN, {u32=1975476260, u64=140507535597604}}], 1048576, 1402000) = 1 [pid 1238] getpid( <unfinished ...> [pid 1237] read(5, <unfinished ...> [pid 1238] <... getpid resumed> ) = 1236 [pid 1237] <... read resumed> "0", 8192) = 1 [pid 1238] sendto(4, "<167>Feb 5 13:26:30 slapd[1236]"..., 56, MSG_NOSIGNAL, NULL, 0 <unfinished ...> [pid 1237] epoll_wait(7, <unfinished ...> [pid 1238] <... sendto resumed> ) = 56 [pid 1238] epoll_ctl(7, EPOLL_CTL_DEL, 31, 0x7fca743f60f4) = 0 [pid 1238] write(31, "\25\3\3\0\32\0\0\0\0\0\0\0\2\2431\246\345i\2013\31\0\f\t2\367: \270)\202", 31) = 31 [pid 1238] shutdown(31, SHUT_RDWR) = 0 [pid 1238] close(31) = 0 [pid 1238] getpid() = 1236 [pid 1238] sendto(4, "<167>Feb 5 13:26:30 slapd[1236]"..., 57, MSG_NOSIGNAL, NULL, 0) = 57 [pid 1238] futex(0x5567c5bf497c, FUTEX_WAIT_PRIVATE, 0, NULL^Cstrace: Process 1236 detached 5e3b2a11 connection_get(19): got connid=1003 5e3b2a11 connection_read(19): checking for input on id=1003 ber_get_next ber_get_next: tag 0x30 len 29 contents: 5e3b2a11 op tag 0x77, time 1580935697 ber_get_next 5e3b2a11 conn=1003 op=0 do_extended ber_scanf fmt ({m) ber: 5e3b2a11 send_ldap_extended: err=0 oid= len=0 5e3b2a11 send_ldap_response: msgid=1 tag=120 err=0 ber_flush2: 14 bytes to sd 19 5e3b2a11 connection_get(19): got connid=1003 5e3b2a11 connection_read(19): checking for input on id=1003 5e3b2a11 connection_read(19): unable to get TLS client DN, error=49 id=1003 5e3b2a19 connection_get(19): got connid=1003 5e3b2a19 connection_read(19): checking for input on id=1003 ber_get_next ber_get_next: tag 0x30 len 83 contents: 5e3b2a19 op tag 0x60, time 1580935705 ber_get_next 5e3b2a19 conn=1003 op=1 do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: 5e3b2a19 >>> dnPrettyNormal: <uid=jschaeffer,ou=End Users,ou=People,dc=harmonywave,dc=cloud> 5e3b2a19 <<< dnPrettyNormal: <uid=jschaeffer,ou=End Users,ou=People,dc=harmonywave,dc=cloud>, <uid=jschaeffer,ou=end users,ou=people,dc=harmonywave,dc=cloud> 5e3b2a19 do_bind: version=3 dn="uid=jschaeffer,ou=End Users,ou=People,dc=harmonywave,dc=cloud" method=128 5e3b2a19 mdb_dn2entry("uid=jschaeffer,ou=end users,ou=people,dc=harmonywave,dc=cloud") 5e3b2a19 => mdb_dn2id("uid=jschaeffer,ou=end users,ou=people,dc=harmonywave,dc=cloud") 5e3b2a19 <= mdb_dn2id: got id=0x26 5e3b2a19 => mdb_entry_decode: 5e3b2a19 <= mdb_entry_decode 5e3b2a19 SASL [conn=1003] Failure: cannot connect to saslauthd server: Permission denied 5e3b2a19 send_ldap_result: conn=1003 op=1 p=3 5e3b2a19 send_ldap_response: msgid=2 tag=97 err=49 ber_flush2: 14 bytes to sd 19 5e3b2a19 connection_get(19): got connid=1003 5e3b2a19 connection_read(19): checking for input on id=1003 ber_get_next ber_get_next: tag 0x30 len 5 contents: 5e3b2a19 op tag 0x42, time 1580935705 ber_get_next 5e3b2a19 ber_get_next on fd 19 failed errno=0 (Success) 5e3b2a19 conn=1003 op=2 do_unbind 5e3b2a19 connection_close: conn=1003 sd=19 ########### # OS INFO # ########### jschaeffer@bllldap01:~$ lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 18.04.3 LTS Release: 18.04 Codename: bionic -- Thanks, Joshua Schaeffer

3 4

Migrating from Active Directory to OpenLDAP
by Клеусов Владимир Сергеевич 07 Feb '20

07 Feb '20

Hi, How do I migrate from Active Directory to OpenLDAP ? That is, I need to migrate users with passwords and user groups

2 1

LTB Debian and CentOS builds (was: OpenLDAP 2.4.49 available, LMDB 0.9.25 available)
by Clément OUDOT 07 Feb '20

07 Feb '20

Le jeu. 30 janv. 2020 à 19:27, OpenLDAP project <project(a)openldap.org> a écrit : > > OpenLDAP 2.4.49 is now available for download as detailed on our download > page: Hello, LDAP Tool Box packages for Debian and CentOS are now available: https://ltb-project.org/download#openldap Clément.

1 0

Re: Unable to build mdb stat tool for linux
by Vijay Kumar 05 Feb '20

05 Feb '20

Thanks for the details Quanah, I did use C/C++ almost 13 years ago, used to build using turboc++ with a specific approach no headers installations followed as remembered. I am trying to get MignW. Openldap officially which compiler it supports ? please let me know details. Thank you. Regards, Vijay Kumar On Wed, Feb 5, 2020 at 12:11 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Wednesday, February 5, 2020 11:38 AM +0530 Vijay Kumar > <pasumarthivijaykumar(a)gmail.com> wrote: > > > #define DEFAULT_MAPSIZE (10 * 10 * 10 * 10 * 10 * 10 * 10 * 10 * > > 1048576) > > You've clearly screwed with the code. Do not make any changes to the > code, > I've already told you this. > > > mdb_stat.c:17:23: fatal error: ac\unistd.h: No such file or directory > > #include <ac\unistd.h> > > Install the headers that provide this header file. > > You haven't said at all what environment you're building under. I > personally use MSYS2. > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > -- Thanks & Regards, Vijay Kumar *+91-94944 44009*

2 1

Unable to build mdb stat tool for linux
by Vijay Kumar 05 Feb '20

05 Feb '20

Hi Team, Can you please let me know once any documentation you have on building mdb_stat tool ? I dont see any documentation on same. */opt/openldap/libraries/liblmdb * *[root@KedarM8 liblmdb]# make* gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -Wuninitialized -c mdb.c mdb.c: In function ‘mdb_env_open2’: mdb.c:615:64: warning: integer overflow in expression [-Woverflow] #define DEFAULT_MAPSIZE (10 * 10 * 10 * 10 * 10 * 10 * 10 * 10 * 1048576) ^ mdb.c:4399:21: note: in expansion of macro ‘DEFAULT_MAPSIZE’ meta.mm_mapsize = DEFAULT_MAPSIZE; ^ gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -Wuninitialized -c midl.c ar rs liblmdb.a mdb.o midl.o ar: creating liblmdb.a gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -Wuninitialized -fPIC -c mdb.c -o mdb.lo mdb.c: In function ‘mdb_env_open2’: mdb.c:615:64: warning: integer overflow in expression [-Woverflow] #define DEFAULT_MAPSIZE (10 * 10 * 10 * 10 * 10 * 10 * 10 * 10 * 1048576) ^ mdb.c:4399:21: note: in expansion of macro ‘DEFAULT_MAPSIZE’ meta.mm_mapsize = DEFAULT_MAPSIZE; ^ gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -Wuninitialized -fPIC -c midl.c -o midl.lo gcc -pthread -shared -o liblmdb.so mdb.lo midl.lo gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -Wuninitialized -c mdb_stat.c *mdb_stat.c:17:23: fatal error: ac\unistd.h: No such file or directory* #include <ac\unistd.h> ^ compilation terminated. make: *** [mdb_stat.o] Error 1 -- Thanks & Regards, Vijay Kumar *+91-94944 44009*

3 2

Re: mdb_put failed: MDB_MAP_FULL: Environment mapsize limit reached(-30792)
by Vijay Kumar 04 Feb '20

04 Feb '20

Ok, i hope they did not do any changes to openldap classes and generated Windows build.! If so, can you please let me know where can i find your company generated windows build.? Regards, Vijay Kumar On Tue, Feb 4, 2020 at 6:53 AM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Tuesday, February 4, 2020 6:11 AM +0530 Vijay Kumar > <pasumarthivijaykumar(a)gmail.com> wrote: > > > > > Yes ofcourse removed, freshly started with whatever you explained on > > property setting to test.! > > > > > > Did you get chance to check once in windows with my observations.? > > My company produces certified builds for OpenLDAP on windows. It works > correctly. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > -- Thanks & Regards, Vijay Kumar *+91-94944 44009*

2 1

Re: mdb_put failed: MDB_MAP_FULL: Environment mapsize limit reached(-30792)
by Vijay Kumar 04 Feb '20

04 Feb '20

Yes ofcourse removed, freshly started with whatever you explained on property setting to test.! Did you get chance to check once in windows with my observations.? Thank you. Regards, Vijay Kumar On Mon, 3 Feb, 2020, 10:08 pm Quanah Gibson-Mount, <quanah(a)symas.com> wrote: > > > --On Monday, February 3, 2020 10:42 AM +0530 Vijay Kumar > <pasumarthivijaykumar(a)gmail.com> wrote: > > > > > Hi Quanah, > > > > > > I did revert all my changes of openldap and try increasing the property > > from slapd.ldif using olcDBMaxSize. > > > > > > below are my observations, if i try to set the value from property, i > > dont understand from where the value 1406945XXXXXX and getting set. > > Did you delete the existing MDB database that was created by your eroneous > code? You likely need to do that before you start trying to do anything > else. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

MultiMaster replication password
by Клеусов Владимир Сергеевич 03 Feb '20

03 Feb '20

Hi Can I write this question here ? I did at https://linuxlasse.net/linux/howtos/OpenLDAP_N-Way_MultiMaster_Replication Everything works. But passwords are not replicated. How to configure password replication?

3 7

Re: (ITS#9159) mdb_put failed: MDB_MAP_FULL: Environment mapsize limit reached(-30792)
by Vijay Kumar 03 Feb '20

03 Feb '20

Hi Quanah, I did revert all my changes of openldap and try increasing the property from slapd.ldif using olcDBMaxSize. below are my observations, if i try to set the value from property, i dont understand from where the value *1406945XXXXXX *and getting set. Please check the details mentioned. *1) olcDbMaxSize: 10485760* >mdb_stat.exe -rne "C:\testMaxSize2\mdb\data.mdb" Environment Info Map address: 0000000000000000 Map size: 140694549168128 Page size: 4096 Max pages: 34349255168 Number of pages used: 2 Last transaction ID: 0 Max readers: 126 Number of readers used: 0 Reader Table Status (no active readers) >slapd.exe -T add -F ..\slapd.d -l backupContent.ldif 5e37a371 mdb_db_open: database "o=abc.net" cannot be opened: ⁿ (87). Restore from backup! 5e37a371 backend_startup_one (type=mdb, suffix="o=abc.net"): bi_db_open failed! (87) slap_startup failed *2) olcDbMaxSize: 1048576* >slapd.exe -T add -F ..\slapd.d -l backupContent.ldif 5e37a5ef mdb_db_open: database "o=abc.net" cannot be opened: ⁿ (87). Restore from backup! 5e37a5ef backend_startup_one (type=mdb, suff*ix="o=abc.net <http://abc.net>"): bi_db_open failed! (87)* slap_startup failed >mdb_stat.exe -rne "C:\testMaxSize2\mdb\data.mdb" Environment Info Map address: 0000000000000000 Map size: 140694539730944 Page size: 4096 Max pages: 34349252864 Number of pages used: 2 Last transaction ID: 0 Max readers: 126 Number of readers used: 0 Reader Table Status (no active readers) *3) olcDbMaxSize: 1024* >slapd.exe -T add -F ..\slapd.d -l backupContent.ldif 5e37a7fd mdb_db_open: database "o=abc.net" cannot be opened: ⁿ (87). Restore from backup! 5e37a7fd backend_startup_one (type=mdb, suffix="o=abc.net"): bi_db_open failed! (87) slap_startup failed >mdb_stat.exe -rne "C:\testMaxSize2\mdb\data.mdb" Environment Info Map address: 0000000000000000 Map size: 140694538683392 Page size: 4096 Max pages: 34349252608 Number of pages used: 2 Last transaction ID: 0 Max readers: 126 Number of readers used: 0 Reader Table Status (no active readers) *5) olcDbMaxSize 10* >slapd.exe -T add -F ..\slapd.d -l backupContent.ldif 5e37a92b mdb_db_open: database "o=abc.net" cannot be opened: ⁿ (87). Restore from backup! 5e37a92b backend_startup_one (type=mdb, suffix="o=abc.net"): bi_db_open failed! (87) slap_startup failed >mdb_stat.exe -rne "C:\testMaxSize2\mdb\data.mdb" Environment Info Map address: 0000000000000000 Map size: 140694538682378 Page size: 4096 Max pages: 34349252608 Number of pages used: 2 Last transaction ID: 0 Max readers: 126 Number of readers used: 0 Reader Table Status (no active readers) *6) olcDbMaxSize 1* >slapd.exe -T add -F ..\slapd.d -l backupContent.ldif 5e37a92b mdb_db_open: database "o=abc.net" cannot be opened: ⁿ (87). Restore from backup! 5e37a92b backend_startup_one (type=mdb, suffix=*"o=abc.net <http://abc.net>"): bi_db_open failed! (87)* slap_startup failed >mdb_stat.exe -rne "C:\testMaxSize2\mdb\data.mdb" Environment Info Map address: 0000000000000000 Map size: *140694538682369* Page size: 4096 Max pages: 34349252608 Number of pages used: 2 Last transaction ID: 0 Max readers: 126 Number of readers used: 0 Reader Table Status (no active readers) 7) olcDbMaxSize not set >mdb_stat.exe -rne "C:\testMaxSize2\mdb\data.mdb" Environment Info Map address: 0000000000000000 Map size: 1048576 Page size: 4096 Max pages: 256 Number of pages used: 254 Last transaction ID: 104 Max readers: 126 Number of readers used: 0 Reader Table Status (no active readers) On Fri, Jan 31, 2020 at 12:56 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Friday, January 31, 2020 12:09 PM +0530 Vijay Kumar > <pasumarthivijaykumar(a)gmail.com> wrote: > > > > > > > > > > > I could see some stats from mdb-stat tool as mentioned below, > > > > > > mdb_stat.exe -rne "C:\openldap\mdb\data.mdb" > > Environment Info > > Map address: 0000000000000000 > > Map size: 268435456 (we have set the value > > as ‭104,857,600,000,000‬ in mdb.c and back_mdb.h files, but it has > > taken only 256 MB, not sure why?) > > > You should be making NO CHANGES to the source code *AT ALL*. The *ONLY* > thing you should be doing is setting a maxsize parameter correctly in the > slapd configuration. PERIOD. I don't know how to be any clearer than > this. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > -- Thanks & Regards, Vijay Kumar *+91-94944 44009*

2 1

termux liblmdb package available (0.9.24)
by Craig Comstock 03 Feb '20

03 Feb '20

Hello, liblmdb is available as a package for the Android app/environment Termux. You can install it with `pkg install liblmdb`. The package script and patch are here: https://github.com/termux/termux-packages/tree/master/packages/liblmdb If you wish to review them and/or improve on them. Thanks, Craig Comstock CFEngineer/digger for Northern.tech

2 1

openSUSE/SLE builds (was: OpenLDAP 2.4.49 available, LMDB 0.9.25 available)
by Michael Ströder 31 Jan '20

31 Jan '20

On 1/30/20 7:17 PM, OpenLDAP project wrote: > OpenLDAP 2.4.49 is now available for download as detailed on our > download page: For those who are impatient to get drop-in builds for openSUSE and SLE: https://build.opensuse.org/package/show/network:ldap/openldap2 These builds replace the system-wide libldap which might break version-pinning in your local installation. So you have to know what you're doing! Also I maintain builds installing in separate prefix /opt/openldap-ms and with reduced feature set (e.g. no back-bdb and no back-hdb): https://build.opensuse.org/package/show/home:stroeder:openldap/openldap-ms Please test. Feedback welcome! BTW: In OBS you can also simply branch the above packages to your own OBS home project and adjust the .spec to your own needs. Ciao, Michael.

1 0

Re: (ITS#9159) mdb_put failed: MDB_MAP_FULL: Environment mapsize limit reached(-30792)
by Vijay Kumar 31 Jan '20

31 Jan '20

I could see some stats from mdb-stat tool as mentioned below, mdb_stat.exe -rne "C:\openldap\mdb\data.mdb" Environment Info Map address: 0000000000000000 Map size: 268435456 (we have set the value as *‭104,857,600,000,000‬* in mdb.c and back_mdb.h files, but it has taken only 256 MB, not sure why?) Page size: 4096 Max pages: 65536 Number of pages used: 65527 Last transaction ID: 9555 Max readers: 126 Number of readers used: 0 Reader Table Status (no active readers) when i try to increase to set the dbMaxSize it fails, *addDbMaxSize.ldif * has content as mentioned below, dn: olcDatabase={1}mdb,cn=config changetype: modify add: olcDbMaxSize olcDbMaxSize: 1073741824 olcDbMaxSize: *1073741824 - stops the service in windows* openldap \bin>ldapmodify -H ldaps://localhost:6565 -D cn=admin,cn=config -w d -f addDbMaxSize.ldif modifying entry "olcDatabase={1}mdb,cn=config" *ldap_modify: Other (e.g., implementation specific) error (80) additional info: failed to reopen database, rc=87* olcDbMaxSize: ‭*536870912‬ - failed as below* openldap \bin>ldapmodify -H ldaps://localhost:6565 -D cn=admin,cn=config -w d -f addDbMaxSize.ldif modifying entry "olcDatabase={1}mdb,cn=config" *ldap_modify: Invalid syntax (21) additional info: olcDbMaxSize: value #0 invalid per syntax* *back-mdb.h - we added as below* #define DEFAULT_MAPSIZE (10 * 10 * 10 * 10 * 10 * 10 * 10 * 10 * 1048576) mdb.c - we added as below #define DEFAULT_MAPSIZE (10 * 10 * 10 * 10 * 10 * 10 * 10 * 10 * 1048576) if ((i = mdb_env_read_header(env, &meta)) != 0) { if (i != ENOENT) return i; DPUTS("new mdbenv"); newenv = 1; env->me_psize = env->me_os_psize; if (env->me_psize > MAX_PAGESIZE) env->me_psize = MAX_PAGESIZE; memset(&meta, 0, sizeof(meta)); mdb_env_init_meta0(env, &meta); meta.mm_mapsize = DEFAULT_MAPSIZE; } else { env->me_psize = meta.mm_psize; } *1. i am not getting why the size of the map (as per the stats info given above) - 256 MB (268435456) only ? please provide me a clue once to understand this.* *2. Kindly let me know how to get debug logs ? i use DPRINTF, DPUT in mdb.c but dint get see as logs printed.!* *We observed this in Windows 2012 R2 and Window10 OS x64 Arch machines.* Regards, Vijay Kumar On Thu, Jan 30, 2020 at 12:46 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Thursday, January 30, 2020 6:09 AM +0000 > pasumarthivijaykumar(a)gmail.com wrote: > > > --00000000000025b743059d554b79 > > Content-Type: text/plain; charset="UTF-8" > > Content-Transfer-Encoding: quoted-printable > > > > Thanks for your reply I do know that info for windows also is it the > > same.? I am unable to use stats tool also. > > As I already stated, the maxsize parameter specifies the maximum size the > database can reach. > > > As I don=E2=80=99t see any reply from our many mails to > > openldap-technical(a)openldap.org I have created this case to clarify. > > > The openldap-technical list is only open to subscribers, if you want to > post to it you must subscribe first. > > > > Why don=E2=80=99t you forward the query to the concerned team instead > > closi= ng. > > Your query would not be forwarded because you failed to read and/or > understand the documentation. This system is for bug reports only. > > > No reply to us.! > > I did reply. This is clearly shown in the ITS. > > > Please let us know answer to solve a issue.! > > > I already provided you the answer in my earlier response. Set an > approprate maxsize setting, the default of 10MB is clearly too low. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > -- Thanks & Regards, Vijay Kumar *+91-94944 44009*

2 1

Re: How to fetch LDAP Server version using Java
by Vijay Kumar 31 Jan '20

31 Jan '20

Hi Quanah Thanks a lot for your reply. I tried but dint get any reply I think we need to add monitor database. Will try to add the same and let you know. Regards, Vijay Kumar On Thu, Jan 30, 2020 at 10:49 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Thursday, January 30, 2020 2:34 PM +0530 Vijay Kumar > <pasumarthivijaykumar(a)gmail.com> wrote: > > In the future, do not cross post to multiple lists. You were already told > specifically to address your questions to openldap-technical(a)openldap.org. > > supportedLDAPVersion tracks the LDAP version (LDAP version 3), it does not > track the underlying version of OpenLDAP. > > However, if you enable the monitor backend (See the man page for > slapd-monitor(5)), the OpenLDAP version is contained in the monitoredInfo > attribute: > > ldapsearch -x -LLL -H ldap:/// -s base -b cn=monitor monitoredInfo > dn: cn=Monitor > monitoredInfo: OpenLDAP: slapd 2.4.48 (Jan 29 2020 19:43:07) > > This of course requires that your program have permission to read from > that > database. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > -- Thanks & Regards, Vijay Kumar *+91-94944 44009*

1 0

Re: How to use mdb_stat.c - memory-mapped database status tool
by Vijay Kumar 30 Jan '20

30 Jan '20

On Thu, Jan 30, 2020 at 11:29 AM Vijay Kumar <pasumarthivijaykumar(a)gmail.com> wrote: > Hi Team, > > Can i request to let me know how to use > mdb_stat.c - memory-mapped database status tool > > google and docs of openldap dint help me.! > > Thank you. > -- > Thanks & Regards, > > Vijay Kumar > *+91-94944 44009* > -- Thanks & Regards, Vijay Kumar *+91-94944 44009*

2 1

Re: How to fetch LDAP Server version using Java
by Vijay Kumar 30 Jan '20

30 Jan '20

Hi Team, >From my Java Program i am in need to find the LDAP Server version. i am able to get supportedLDAPVersion using below search query, LDAPSearchResults ldapSearchResults = ldapConn.search("", LDAPConnection.SCOPE_BASE, "(objectclass=*)", new String[] {"supportedLDAPVersion"}, false); No results found, when i try to use vendorVersion and vendorName (like that queried like below) ldapSearchResults = ldapConn.search("", LDAPConnection.SCOPE_BASE, "(objectclass=*)", new String[] {"vendorVersion"}, false) is there any approach that can follow, please let me know. i am need to get info as below, root@docker_container:/etc/ldap/slapd.d# ldapsearch -VV ldapsearch: @(#) $OpenLDAP: ldapsearch (Jul 30 2019 16:24:19) $ Debian OpenLDAP Maintainers < pkg-openldap-devel(a)lists.alioth.debian.org> * (LDAP library: OpenLDAP *20448*)* root@docker_container:/etc/ldap/slapd.d# Thank you. -- Thanks & Regards, Vijay Kumar *+91-94944 44009*

2 1

Re: CentOS drops OpenLDAP servers package starting with 8.1
by Dave Macias 30 Jan '20

30 Jan '20

> > The CentOS project has now also elected to drop support for the OpenLDAP > server package starting with 8.1: > > <https://bugs.centos.org/view.php?id=16959> > > I will note that Symas continues to offer free packages for Centos8/RHEL8 > users based off of the Centos8.0 package. We will likely move this to > mirror > the Fedora package (which is what the CentOS package was based on). > > <https://symas.com/linuxopenldap/> > That was expected! Testing CentOS8 distro is my next project since 7 will eventually reach EOL....gotta get ready Thank you for the continued support!!

1 0

RE24 testing call #2 (2.4.49) LMDB RE0.9 testing call (0.9.25)
by Quanah Gibson-Mount 30 Jan '20

30 Jan '20

This is the second testing call for OpenLDAP 2.4.49. Depending on the results, this may be the only testing call. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.4.49 Engineering Added slapd-monitor database entry count for slapd-mdb (ITS#9154) Fixed client tools to not add controls on cancel/abandon (ITS#9145) Fixed client tools SyncInfo message to be LDIF compliant (ITS#8116) Fixed libldap to correctly free sb (ITS#9081, ITS#8755) Fixed libldap descriptor leak if ldaps fails (ITS#9147) Fixed libldap remove unnecessary global mutex for GnuTLS (ITS#9069) Fixed slapd syntax evaluation of preferredDeliveryMethod (ITS#9067) Fixed slapd to relax domainScope control check (ITS#9100) Fixed slapd to have cleaner error handling during connection setup (ITS#9112) Fixed slapd data check when processing cancel exop (ITS#9124) Fixed slapd attribute description processing (ITS#9128) Fixed slapd-ldap to set oldctrls correctly (ITS#9076) Fixed slapd-mdb to honor unchecked limit with alias deref (ITS#7657) Fixed slapd-mdb missing final commit with slapindex (ITS#9095) Fixed slapd-mdb drop attr mappings added in an aborted txn (ITS#9091) Fixed slapd-mdb nosync FLAG configuration handling (ITS#9150) Fixed slapd-monitor global operation counter reporting (ITS#9119) Fixed slapo-ppolicy when used with slapauth (ITS#8629) Fixed slapo-ppolicy to add a missed normalised copy of pwdChangedTime (ITS#9126) Fixed slapo-syncprov fix sessionlog init (ITS#9146) Fixed slapo-unique loop termination (ITS#9077) Build Environment Fix mkdep to honor TMPDIR if set (ITS#9062) Remove ICU library detection (ITS#9144) Update config.guess and config.sub to support newer architectures (ITS#7855) Documentation admin24 - Fix inconsistent whitespace in replication section (ITS#9153) slapd-config(5)/slapd.conf(5) - Fix missing bold tag for keyword (ITS#9063) slapd-ldap(5) - Document "tls none" option (ITS#9071) slapo-ppolicy(5) - Correctly document pwdGraceAuthnLimit (ITS#9065) LMDB 0.9.25 Engineering ITS#9068 fix mdb_dump/load backslashes in printable content ITS#9118 add MAP_NOSYNC for FreeBSD ITS#9155 free mt_spill_pgs in non-nested txn on end Thanks, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 4

CentOS drops OpenLDAP servers package starting with 8.1
by Quanah Gibson-Mount 30 Jan '20

30 Jan '20

The CentOS project has now also elected to drop support for the OpenLDAP server package starting with 8.1: <https://bugs.centos.org/view.php?id=16959> I will note that Symas continues to offer free packages for Centos8/RHEL8 users based off of the Centos8.0 package. We will likely move this to mirror the Fedora package (which is what the CentOS package was based on). <https://symas.com/linuxopenldap/> Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: RE24 testing call #2 (2.4.49) LMDB RE0.9 testing call (0.9.25)
by Lucio De Re 30 Jan '20

30 Jan '20

On 1/28/20, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > This is the second testing call for OpenLDAP 2.4.49. Depending on the > results, this may be the only testing call. > Under NetBSD 8.1 (i386) compilation was eventually successful: - SASL is not in the distribution, so the "/usr/pkg" prefix was needed in a few places; - HDB and BDB need to be disabled as at least one of them is not compatible. When executing "make test", one of LD_LIBRARY_PATH or LD_RUN_PATH (the former, I think) had to be set to /usr/pkg/lib. Perhaps the "rpath" can be set during compilation, I'm not that familiar with the details. Finally, a lot of tests succeeded, albeit slowly (it's an old host), they stopped with this last stanza: >>>>> Starting test060-mt-hot for mdb... running defines.sh Running slapadd to build slapd database... Running slapindex to index slapd database... Starting slapd on TCP/IP port 9011... /home/lucio/tmp/openldap-OPENLDAP_REL_ENG_2_4-c5ea2bb/tests/../servers/slapd/slapd -s0 -f /home/lucio/tmp/openldap-OPENLDAP_REL_ENG_2_4-c5ea2bb/tests/testrun/slapd.1.conf -h ldap://localhost:9011/ -d stats Testing basic monitor search... Monitor searches Testing basic mt-hot search: 1 threads (1 x 50000) loops... ./progs/slapd-mtread -H ldap://localhost:9011/ -D cn=Manager,dc=example,dc=com -w secret -e cn=Monitor -m 1 -L 1 -l 50000 Testing basic mt-hot search: 5 threads (1 x 10000) loops... ./progs/slapd-mtread -H ldap://localhost:9011/ -D cn=Manager,dc=example,dc=com -w secret -e cn=Monitor -m 5 -L 1 -l 10000 Testing basic mt-hot search: 100 threads (5 x 100) loops... ./progs/slapd-mtread -H ldap://localhost:9011/ -D cn=Manager,dc=example,dc=com -w secret -e cn=Monitor -m 100 -L 5 -l 100 slapd-mtread failed (1)! >>>>> test060-mt-hot failed for mdb (exit 1) *** Error code 1 Stop. make[2]: stopped in /home/lucio/tmp/openldap-OPENLDAP_REL_ENG_2_4-c5ea2bb/tests *** Error code 1 Stop. make[1]: stopped in /home/lucio/tmp/openldap-OPENLDAP_REL_ENG_2_4-c5ea2bb/tests *** Error code 1 Stop. make: stopped in /home/lucio/tmp/openldap-OPENLDAP_REL_ENG_2_4-c5ea2bb I'm afraid I don't see anything else that you may find useful. Lucio.

3 3

cn=config replication stops after adding olcAccess entries
by Jan Hugo Prins 28 Jan '20

28 Jan '20

Hello, I'm trying to setup a new MMR cluster. I started the installation using the documentation from: https://www.openldap.org/doc/admin24/replication.html#N-Way%20Multi-Master OS: CentOS 7.7. CentOS RPM packages OpenLDAP version 2.4.44-21 The base installation works fine, all schema's loaded etc. At first I was thinking everything was fine, until I started testing failure scenario's. When I tried to rebuild a failed node I noticed that it wouldn't be populated. cn=config was empty except for the base config and only some data was replicated. After a lot of searching I found that adding any olcAccess rules would destroy the replication. With the olcAccess lines in the config below only the schemas are replicated. When I remove all olcAccess lines all replication works. The base config I use for a node looks like this: dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1 ldap://ldap01.internal olcServerID: 2 ldap://ldap02.internal olcServerID: 3 ldap://ldap03.internal olcPidFile: /var/run/openldap/slapd.pid olcLogLevel: 16512 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=config olcRootPW: eich4mieceeB6ma9ehah olcSyncRepl: rid=001 provider=ldap://ldap01.internal binddn="cn=config" bindmethod=simple credentials=XXXXXX searchbase="cn=config" type=refreshAndPersist retry="5 5 300 +" timeout=1 olcSyncRepl: rid=002 provider=ldap://ldap02.internal binddn="cn=config" bindmethod=simple credentials=XXXXXX searchbase="cn=config" type=refreshAndPersist retry="5 5 300 +" timeout=1 olcSyncRepl: rid=003 provider=ldap://ldap03.internal binddn="cn=config" bindmethod=simple credentials=XXXXXX searchbase="cn=config" type=refreshAndPersist retry="5 5 300 +" timeout=1 olcMirrorMode: TRUE dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulePath: /usr/lib64/openldap/ olcModuleLoad: syncprov.la dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov The complete config on a running node looks like this: dn: cn=config objectClass: olcGlobal objectClass: olcConfig objectClass: top cn: config olcLogLevel: 16512 olcPidFile: /var/run/openldap/slapd.pid olcServerID: 1 ldap://ldap01.internal olcServerID: 2 ldap://ldap02.internal olcServerID: 3 ldap://ldap03.internal dn: cn=module{0},cn=config objectClass: olcModuleList objectClass: olcConfig objectClass: top cn: module{0} olcModuleLoad: {0}syncprov.la olcModulePath: /usr/lib64/openldap/ dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcConfig objectClass: olcFrontendConfig objectClass: top olcAccess: {0}to dn.subtree="dc=domain,dc=com" attrs=userPassword,shadowLastChange by self write by dn.base="cn=bbsyncrepl, dc=domain,dc=com" read by anonymous auth by * none olcAccess: {1}to dn.subtree="dc=domain,dc=com" attrs=sambaNTPassword by self write by dn.base="cn=bbsyncrepl, dc=domain,dc=com" read by anonymous auth by * none olcAccess: {2}to dn.subtree="dc=domain,dc=com" attrs=sambaLMPassword by self write by dn.base="cn=bbsyncrepl, dc=domain,dc=com" read by anonymous auth by * none olcAccess: {3}to dn.subtree="dc=domain,dc=com" by dn.base="cn=bbsyncrepl,dc=domain,dc=com" read by self write by * read olcAddContentAcl: FALSE olcDatabase: {-1}frontend olcLastMod: TRUE olcMaxDerefDepth: 0 olcMonitoring: TRUE olcReadOnly: FALSE olcSchemaDN: cn=Subschema olcSyncUseSubentry: FALSE dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig objectClass: olcConfig objectClass: top olcDatabase: {0}config olcMirrorMode: TRUE olcMonitoring: TRUE olcRootDN: cn=config olcRootPW: XXXXXX olcSyncrepl: {0}rid=001 provider=ldap://ldap01.internal binddn="cn=config" bindmethod=simple credentials=XXXXXX searchbase="cn=config" type=refreshAndPersist retry="5 5 300 +" timeout=1 olcSyncrepl: {1}rid=002 provider=ldap://ldap02.internal binddn="cn=config" bindmethod=simple credentials=XXXXXX searchbase="cn=config" type=refreshAndPersist retry="5 5 300 +" timeout=1 olcSyncrepl: {2}rid=003 provider=ldap://ldap03.internal binddn="cn=config" bindmethod=simple credentials=XXXXXX searchbase="cn=config" type=refreshAndPersist retry="5 5 300 +" timeout=1 dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcSyncProvConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {0}syncprov dn: olcOverlay={1}syncprov,olcDatabase={0}config,cn=config objectClass: olcSyncProvConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {1}syncprov dn: olcDatabase={1}bdb,cn=config objectClass: olcBdbConfig objectClass: olcDatabaseConfig objectClass: olcConfig objectClass: top olcAddContentAcl: FALSE olcDatabase: {1}bdb olcDbCacheFree: 1 olcDbCacheSize: 1000000 olcDbCheckpoint: 512 5 olcDbDirectory: /var/lib/ldap olcDbDirtyRead: FALSE olcDbDNcacheSize: 0 olcDbIDLcacheSize: 0 olcDbIndex: default sub olcDbIndex: objectClass eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: cn eq,subinitial olcDbIndex: uid pres,eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: mailLocalAddress pres,eq olcDbIndex: memberUid eq olcDbIndex: mail eq,subinitial olcDbIndex: mailRoutingAddress pres,eq olcDbIndex: sambaSID eq olcDbIndex: sn eq,subinitial olcDbIndex: sambaPrimaryGroupSID eq olcDbIndex: givenName eq,subinitial olcDbIndex: sendmailMTAHost pres,eq,sub olcDbIndex: sambaDomainName eq olcDbIndex: sendmailMTAKey pres,eq,sub olcDbIndex: sendmailMTAMapName pres,eq olcDbIndex: sendmailMTAAliasValue pres,eq olcDbIndex: sendmailMTAMapValue pres,eq olcDbIndex: sendmailMTAAliasGrouping pres,eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbNoSync: FALSE olcDbSearchStack: 16 olcDbShmKey: 0 olcLastMod: TRUE olcLimits: {0}dn.exact="cn=Manager,dc=domain,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcLimits: {1}dn.exact="cn=bbsyncrepl,dc=domain,dc=com" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited olcLimits: {2}dn.exact="cn=incontrol,dc=domain,dc=com" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited olcMaxDerefDepth: 15 olcMirrorMode: TRUE olcMonitoring: TRUE olcReadOnly: FALSE olcRootDN: cn=Manager,dc=domain,dc=com olcRootPW: XXXXXX olcSuffix: dc=domain,dc=com olcSyncrepl: {0}rid=004 provider=ldap://ldap01.internal binddn="cn=Manager,dc=domain,dc=com" bindmethod=simple credentials=XXXXXX searchbase="dc=domain,dc=com" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 network-timeout=0 starttls=no filter="(objectClass=*)" scope=sub attrs="*" schemachecking=off olcSyncrepl: {1}rid=005 provider=ldap://ldap02.internal binddn="cn=Manager,dc=domain,dc=com" bindmethod=simple credentials=XXXXXX searchbase="dc=domain,dc=com" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 network-timeout=0 starttls=no filter="(objectClass=*)" scope=sub attrs="*" schemachecking=off olcSyncrepl: {2}rid=006 provider=ldap://ldap03.internal binddn="cn=Manager,dc=domain,dc=com" bindmethod=simple credentials=XXXXXX searchbase="dc=domain,dc=com" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 network-timeout=0 starttls=no filter="(objectClass=*)" scope=sub attrs="*" schemachecking=off dn: olcOverlay={0}syncprov,olcDatabase={1}bdb,cn=config objectClass: olcSyncProvConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {0}syncprov In the logging I see the following: Jan 27 09:37:34 radius01.internal slapd[16596]: 5e2ea14e => access_allowed: search access to "cn=config" "entry" requested Jan 27 09:37:34 radius01.internal slapd[16596]: 5e2ea14e <= root access granted Jan 27 09:37:34 radius01.internal slapd[16596]: 5e2ea14e => access_allowed: search access granted by manage(=mwrscxd) Jan 27 09:37:34 radius01.internal slapd[16596]: 5e2ea14e => access_allowed: search access to "cn=config" "objectClass" requested Jan 27 09:37:34 radius01.internal slapd[16596]: 5e2ea14e <= root access granted Jan 27 09:37:34 radius01.internal slapd[16596]: 5e2ea14e => access_allowed: search access granted by manage(=mwrscxd) Jan 27 09:37:34 radius01.internal slapd[16596]: 5e2ea14e => access_allowed: search access to "cn=config" "entry" requested Jan 27 09:37:34 radius01.internal slapd[16596]: 5e2ea14e <= root access granted Jan 27 09:37:34 radius01.internal slapd[16596]: 5e2ea14e => access_allowed: search access granted by manage(=mwrscxd) Jan 27 09:37:34 radius01.internal slapd[16596]: 5e2ea14e => access_allowed: search access to "cn=config" "objectClass" requested Jan 27 09:37:34 radius01.internal slapd[16596]: 5e2ea14e <= root access granted Jan 27 09:37:34 radius01.internal slapd[16596]: 5e2ea14e => access_allowed: search access granted by manage(=mwrscxd) Jan 27 09:37:34 radius01.internal slapd[16596]: 5e2ea14e => access_allowed: search access to "cn=config" "entry" requested Jan 27 09:37:34 radius01.internal slapd[16596]: 5e2ea14e <= root access granted Jan 27 09:37:34 radius01.internal slapd[16596]: 5e2ea14e => access_allowed: search access granted by manage(=mwrscxd) Jan 27 09:37:34 radius01.internal slapd[16596]: 5e2ea14e => access_allowed: search access to "cn=config" "objectClass" requested Jan 27 09:37:34 radius01.internal slapd[16596]: 5e2ea14e <= root access granted Jan 27 09:37:34 radius01.internal slapd[16596]: 5e2ea14e => access_allowed: search access granted by manage(=mwrscxd) Jan 27 09:37:34 radius01.internal slapd[16596]: 5e2ea14e => access_allowed: read access to "cn=config" "entry" requested Jan 27 09:37:34 radius01.internal slapd[16596]: 5e2ea14e <= root access granted But also: Jan 27 09:38:36 radius01.internal slapd[16596]: 5e2ea18c do_syncrep2: rid=003 LDAP_RES_SEARCH_RESULT Jan 27 09:38:36 radius01.internal slapd[16596]: 5e2ea18c do_syncrep2: rid=003 LDAP_RES_SEARCH_RESULT (53) Server is unwilling to perform Jan 27 09:38:36 radius01.internal slapd[16596]: 5e2ea18c do_syncrep2: rid=003 (53) Server is unwilling to perform Jan 27 09:38:36 radius01.internal slapd[16596]: 5e2ea18c do_syncrepl: rid=003 rc -2 retrying Jan 27 09:39:30 radius01.internal slapd[16596]: 5e2ea1c2 do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT Jan 27 09:39:30 radius01.internal slapd[16596]: 5e2ea1c2 do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT (53) Server is unwilling to perform Jan 27 09:39:30 radius01.internal slapd[16596]: 5e2ea1c2 do_syncrep2: rid=002 (53) Server is unwilling to perform Jan 27 09:39:30 radius01.internal slapd[16596]: 5e2ea1c2 do_syncrepl: rid=002 rc -2 retrying Something else I see, when I use jxplorer to look at the content of a server using the cn=config credentials I would expect to see all values including the empty values. On a server without olcAccess lines I see this, but when there are olcAccess lines I only see the configured values. All unset values are not visible. Any help is appreciated. Thank you very much. Jan Hugo Prins

2 3

Re: LDAPS Multi-master replication
by Quanah Gibson-Mount 28 Jan '20

28 Jan '20

Hello, Please keep replies on the list. --On Tuesday, January 28, 2020 8:06 AM +0000 Клеусов Владимир Сергеевич <Kleusov.Vladimir(a)wildberries.ru> wrote: > Fixed Not sure what you're saying was fixed. There was not really any errors discussed in your prior email, simply a note that the replication you were configurating would only replicate the cn=config database. Your modification appears to keep that behavior. > dn: olcDatabase={0}config,cn=config > changetype: modify > replace: olcSyncRepl > olcSyncRepl: rid=001 provider=ldaps://infra-ldap-m9.wb.ru > searchbase="cn=config" bindmethod=simple credentials=5fX?BLR2 > binddn="cn=admin,cn=config" starttls=no > tls_cert="/etc/ldap/sasl2/wb.ru.crt" tls_key="/etc/ldap/sasl2/wb.ru.key" > tls_cacert="/etc/ldap/sasl2/commercial_ca.crt" tls_reqcert=allow > type=refreshAndPersist retry="5 5 300 5" timeout=1 > olcSyncRepl: rid=002 provider=ldaps://infra-ldap.dl.wb.ru > searchbase="cn=config" bindmethod=simple credentials=5fX?BLR2 > binddn="cn=admin,cn=config" credentials=5fX?BLR2 starttls=no > tls_cert="/etc/ldap/sasl2/w.ru.crt" tls_key="/etc/ldap/sasl2/wb.ru.key" > tls_cacert="/etc/ldap/sasl2/commercial_ca.crt" tls_reqcert=allow > type=refreshAndPersist retry="5 5 300 5" timeout=1 > olcSyncRepl: rid=003 provider=ldaps://infra-ldap.dp.wb.ru > searchbase="cn=config" bindmethod=simple credentials=5fX?BLR2 > binddn="cn=admin,cn=config" starttls=no > tls_cert="/etc/ldap/sasl2/wb.ru.crt" > tls_key="/etc/ldap/sasl2/wb.ru.key"tls_cacert="/etc/ldap/sasl2/commercial > _ca.crt" tls_reqcert=allow type=refreshAndPersist retry="5 5 300 5" > timeout=1 Your above configuration seems very odd. You are not doing client cert authentication via SASL EXTERNAL, and yet you've specified a client cert and key. I would expect the only TLS configuration bits to be for the CA cert. > But in logs on each server > slap_client_connect: URI=ldaps://infra-ldap.dl.wb.ru > DN="cn=admin,cn=config" ldap_sasl_bind_s failed So it's not able to bind with the configuration to the other server. > openssl s_client -connect infra-ldap.dp.wb.ru:636 > Verify return code: 0 (ok) > Do I need to specify port 636 in steps 5 and 7 ? For example, it was > ldaps:/ / infra-ldap-m9.wb. ru and will become ldaps://infra-ldap-m9.wb. > ru:636 No, port 636 is the default for ldaps. > And how else can you figure out what's wrong ? I would use the ldapwhoami utility to ensure you can bind with the specified identity to each server. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

LDAPS Multi-master replication
by Клеусов Владимир Сергеевич 27 Jan '20

27 Jan '20

Hi I plan to configure Multi-master replication LDAPS on 3 servers. Are my steps correct ? 1) On each server dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: syncprov 2) On server 1 dn: cn=config changeType: modify add: olcServerID olcServerID: 1 3) On server 2 dn: cn=config changeType: modify add: olcServerID olcServerID: 2 4) On server 3 dn: cn=config changeType: modify add: olcServerID olcServerID: 3 4) On each server dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW olcRootPW: 5fX?BLR2 5) On each server dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 ldaps://infa1.domain.com olcServerID: 2 ldaps://infra2.domain.com olcServerID: 3 ldaps://infra3.domain.<ldaps://infra3.test.local>com 6) On each server dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov 7) On each server dn: olcDatabase={0}config,cn=config changetype: modify replace: olcSyncRepl olcSyncRepl: rid=001 provider=ldaps://infra1.domain.com binddn="cn=admin,cn=config" bindmethod=sasl saslmech=EXTERNAL starttls=no tls_cert="/etc/ldap/sasl2/cert.ru.crt" tls_key="/etc/ldap/sasl2/cert.ru.crt" tls_cacert="/etc/ldap/sasl2/comodo.crt" tls_reqcert=allow credentials=5fX?BLR2 searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=002 provider=ldaps://infra2.domain.comn binddn="cn=admin,cn=config" bindmethod=sasl saslmech=EXTERNAL starttls=no tls_cert="/etc/ldap/sasl2/cert.ru.crt" tls_key="/etc/ldap/sasl2/cert.ru.crt" tls_cacert="/etc/ldap/sasl2/comodo.crt" tls_reqcert=allow credentials=5fX?BLR2 searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=003 provider=ldaps://infra3.domain.com binddn="cn=admin,cn=config" bindmethod=sasl saslmech=EXTERNAL starttls=no tls_cert="/etc/ldap/sasl2/cert.ru.crt" tls_key="/etc/ldap/sasl2/cert.ru.crt" tls_cacert="/etc/ldap/sasl2/comodo.crt" tls_reqcert=allow credentials=5fX?BLR2 searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 - add: olcMirrorMode olcMirrorMode: TRUE Is this correct ?

2 1

RE24 testing call (2.4.49) LMDB RE0.9 testing call (0.9.25)
by Quanah Gibson-Mount 27 Jan '20

27 Jan '20

This is the first testing call for OpenLDAP 2.4.49. Depending on the results, this may be the only testing call. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.4.49 Engineering Fixed client tools to not add controls on cancel/abandon (ITS#9145) Fixed libldap to correctly free sb (ITS#9081, ITS#8755) Fixed libldap descriptor leak if ldaps fails (ITS#9147) Fixed libldap remove unnecessary global mutex for GnuTLS (ITS#9069) Fixed slapd syntax evaluation of preferredDeliveryMethod (ITS#9067) Fixed slapd to relax domainScope control check (ITS#9100) Fixed slapd to have cleaner error handling during connection setup (ITS#9112) Fixed slapd data check when processing cancel exop (ITS#9124) Fixed slapd attribute description processing (ITS#9128) Fixed slapd-ldap to set oldctrls correctly (ITS#9076) Fixed slapd-mdb to honor unchecked limit with alias deref (ITS#7657) Fixed slapd-mdb missing final commit with slapindex (ITS#9095) Fixed slapd-mdb drop attr mappings added in an aborted txn (ITS#9091) Fixed slapd-mdb nosync FLAG configuration handling (ITS#9150) Fixed slapd-monitor global operation counter reporting (ITS#9119) Fixed slapo-ppolicy when used with slapauth (ITS#8629) Fixed slapo-syncprov fix sessionlog init (ITS#9146) Fixed slapo-unique loop termination (ITS#9077) Build Environment Fix mkdep to honor TMPDIR if set (ITS#9062) Remove ICU library detection (ITS#9144) Documentation slapd-config(5)/slapd.conf(5) - Fix missing bold tag for keyword (ITS#9063) slapd-ldap(5) - Document "tls none" option (ITS#9071) slapo-ppolicy(5) - Correctly document pwdGraceAuthnLimit (ITS#9065) LMDB 0.9.25 Engineering ITS#9068 fix mdb_dump/load backslashes in printable content ITS#9118 add MAP_NOSYNC for FreeBSD Thanks, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

4 6

multimaster delta syncrepl inconsistent attribute values
by Zach Hanson Hart 27 Jan '20

27 Jan '20

I am seeing inconsistent values for an attribute after conflicting writes. I mostly followed https://mishikal.wordpress.com/2019/04/23/configuring-mmr-using-delta-syncr… for the setup, and mostly followed test063-delta-multimaster from the source code for the test scenario. The problem is that when I do conflicting writes while replication is broken, after replication is restored, the entry ends up with different values for an employeeNumber but everything else the same. My cluster has 3 nodes When all is said and done, the entry looks like the following on two nodes: dn: cn=fakeentryfortesting,ou=people,dc=temple,dc=edu objectClass: inetOrgPerson cn: fakeentryfortesting sn: fakeentryfortesting givenName: fakeentryfortesting carLicense: 123-XYZ description: take two from 16 description: take two from 17 description: written on 16 description: written on 17 employeeNumber: from16 employeeType: deadwood entryCSN: 20200124200603.270449Z#000000#075#000000 entryDN: cn=fakeentryfortesting,ou=people,dc=temple,dc=edu entryUUID: 737fddce-d330-1039-89fc-4599653df8c5 hasSubordinates: FALSE modifiersName: cn=admin,dc=temple,dc=edu modifyTimestamp: 20200124200603Z createTimestamp: 20200124200419Z creatorsName: cn=admin,dc=temple,dc=edu structuralObjectClass: inetOrgPerson subschemaSubentry: cn=Subschema BUT, on one node, it has employeeNumber: from17 as the only difference. >From an earlier post, this is not expected behavior. I'm including some info here in hopes that it's enough to get a workaround. If not, I can provide whatever debugging info is needed. This is a source compiled slapd 2.4.48 running on RHEL 7.7 with a preloaded libtcmalloc.so.4. I experienced the same behavior with 2.4.45. Some gory details... -------------- Overview -------------- I initially set up a single node as standalone. I then added a small ldif to give a tree to replicate. Then, I made the node do delta multimaster. Details of this are further down. I wrote an entry and verified that it got the correct Server ID in the contextCSN. I did ldapsearch -H ldapi:// -Y external -LLL -b cn=config >config.ldif to save the resulting configuration. Then I did a slapadd of that to another fresh node with empty slapd.d and database folders. It synced the data as expected. I repeated on another node. So, I have 3 nodes with identical configurations, call them 16, 17 and 18. Replication seems to be working as expected. slapd is run with: -h ldapi:/// ldaps://pre-ldapr16.temple.edu (or pre-ldapr17 or 18, depending on the node). I verified many, many times that these are identical to what's in the olcServerID, and identical to the provider in the olcSyncrepl attribute. I'm the only one accessing these nodes right now, and certainly the only one using this test DN. ------------- TEST SCENARIO ------------- My test for this mostly follows test063-delta-multimaster. Below, $TESTDN is cn=fakeentryfortesting,ou=people,dc=temple,dc=edu. It seeds a test entry and makes sure it is the same on each node: dn: $TESTDN objectClass: inetorgperson cn: fakeentryfortesting sn: fakeentryfortesting givenName: $TESTCN description: test It breaks replication on each node by replacing the password in the olcSyncrepl values with a wrong password. Below, $X is 16, 17 or 18, depending on the node. For each of the three nodes, it applies: dn: $TESTDN changetype: modify add: description description: written on $X Then for each node it applies: dn: $TESTDN changetype: modify delete: description description: test - add: description description: take two from $X Then on 16, it applies: dn: $TESTDN changetype: modify add: carLicense carLicense: 123-XYZ - add: employeeNumber employeeNumber: from$X and on a different node it applies: dn: $TESTDN changetype: modify add: employeeType employeeType: deadwood - add: employeeNumber employeeNumber: from$X It then restores replication and checks the entry on the different nodes. ------------------ INITIAL STANDALONE CONFIG ------------------ dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/openldap/slapd.args olcAuthzPolicy: to olcAuthzRegexp: {0}uid=ldap/([^,]*),cn=PREKDC.TEMPLE.EDU,cn=gssapi,cn=auth $1 olcConnMaxPending: 101 olcLogLevel: stats stats2 olcPidFile: /var/run/openldap/slapd.pid olcReadOnly: FALSE olcSecurity: simple_bind=128 olcSecurity: tls=0 olcSecurity: ssf=71 olcSockbufMaxIncoming: 22143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 8 olcTLSCACertificateFile: /etc/ssl/certs/intermediate.crt olcTLSCACertificatePath: /etc/openldap/certs olcTLSCertificateFile: /etc/ssl/certs/ldap.pem olcTLSCertificateKeyFile: /etc/ssl/private/ldap.key.pem olcTLSCipherSuite: ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+ AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS:!RC4:!3DES:!eNULL:!PSK olcTLSDHParamFile: /etc/ssl/private/dhparam.bin olcTLSProtocolMin: 3.2 olcToolThreads: 2 dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/local/libexec/openldap olcModuleLoad: {0}back_mdb olcModuleLoad: {1}auditlog olcModuleLoad: {2}unique dn: cn=schema,cn=config # ... entry and subtree omitted for brevity dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0} to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=externa l,cn=auth manage by dn.base="cn=replicator,dc=temple,dc=edu" manage by * brea k olcAccess: {1}to dn.base="cn=Subschema" by * read olcAccess: {2}to dn.exact="" by * read olcLastMod: TRUE olcReadOnly: FALSE olcSizeLimit: size.soft=2000 size.hard=1000000 olcTimeLimit: time.soft=300 time.hard=3600 olcPasswordHash: {SSHA} olcSortVals: hasMember dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by dn.base="cn=replicator,dc=temple,dc=edu" read by dn.exact= "cn=admin,dc=temple,dc=edu" manage by * break olcAccess: {1}to dn.base="cn=Subschema" by * read olcAccess: {2}to dn.exact="" by * read olcAccess: {3}to * by * none olcAddContentAcl: TRUE olcLastMod: TRUE olcRootDN: cn=admin,cn=config olcRootPW: {SSHA}.......... olcMonitoring: FALSE dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /usr/local/var/lib/ldap/rootdb olcSuffix: dc=temple,dc=edu olcAccess: {0} to dn.exact="cn=Subschema" by * read olcAccess: {1} to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=externa l,cn=auth manage by dn.base="cn=replicator,dc=temple,dc=edu" manage by * brea k olcAccess: {2} to attrs=userPassword by * auth olcAccess: {3} to dn.exact="" by * read olcLastMod: TRUE olcLimits: {0}dn.base="cn=replicator,dc=temple,dc=edu" size=unlimited time=unl imited olcRootDN: cn=admin,dc=temple,dc=edu olcRootPW: {SSHA}................. olcMonitoring: TRUE olcDbEnvFlags: nosync olcDbIndex: default eq olcDbIndex: uid pres,eq,sub olcDbIndex: uidNumber,gidNumber eq olcDbIndex: member,memberUid eq olcDbIndex: templeEduTUID eq,sub olcDbIndex: templeEduTUNIC eq # other indexes omitted olcDbIndex: cn,sn pres,eq,approx,sub olcDbIndex: mail pres,eq,sub olcDbIndex: objectClass pres,eq olcDbIndex: loginShell pres,eq olcDbIndex: entryCSN,entryUUID olcDbIndex: givenName,o,name,ou,displayName,eduPersonNicknameeq,sub olcDbIndex: hasMember eq olcDbIndex: mailAlternateAddress eq,sub olcDbIndex: manager eq olcDbIndex: owner eq olcDbIndex: uniqueMember eq olcDbMaxSize: 17179869184 dn: olcOverlay={0}auditlog,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcAuditLogConfig olcOverlay: {0}auditlog olcAuditlogFile: /var/log/ldap/audit.ldif dn: olcOverlay={1}unique,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcUniqueConfig olcOverlay: {1}unique olcUniqueAttribute: templeEduTUNA olcUniqueAttribute: templeEduTUid -------------- INITIAL DATA -------------- dn: dc=temple,dc=edu objectClass: dcObject objectClass: organization o: temple.edu dc: temple dn: cn=replicator,dc=temple,dc=edu objectClass: simpleSecurityObject objectClass: organizationalRole cn: replicator description: LDAP replicator userPassword: {SSHA}.... dn: ou=people,dc=temple,dc=edu objectClass: top objectClass: organizationalUnit ou: people ------------------ MODIFICATION TO MAKE IT DELTA MMR ------------------ dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: syncprov olcModuleLoad: accesslog dn: cn=config changetype: modify replace: olcServerID olcServerID: 116 ldaps://pre-ldapr16.temple.edu olcServerID: 117 ldaps://pre-ldapr17.temple.edu olcServerID: 118 ldaps://pre-ldapr18.temple.edu dn: olcDatabase={2}mdb,cn=config changetype: add objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {2}mdb olcDbDirectory: /usr/local/var/lib/ldap/accesslog olcSuffix: cn=accesslog olcAccess: {0}to dn.subtree="cn=accesslog" by dn.exact="cn=replicator,dc=temple,dc=edu" read by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=config olcLimits: dn.exact="cn=replicator,dc=temple,dc=edu" time=unlimited size=unlimited olcSizeLimit: unlimited olcTimeLimit: unlimited olcMonitoring: TRUE olcDbCheckpoint: 0 0 olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart,reqDN,entryUUID eq olcDbMode: 0600 olcDbSearchStack: 16 olcDbMaxsize: 85899345920 dn: olcOverlay={0}syncprov,olcDatabase={2}mdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE olcSpReloadHint: TRUE dn: olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 20 10 olcSpSessionlog: 10000000 olcSpReloadHint: TRUE dn: olcOverlay={1}accesslog,olcDatabase={1}mdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {1}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogSuccess: TRUE olcAccessLogPurge: 01+00:00 00+04:00 dn: olcDatabase={1}mdb,cn=config changetype: modify add: olcSyncrepl olcSyncrepl: {0}rid=306 provider=ldaps://pre-ldapr16.temple.edu bindmethod=simple binddn="cn=replicator,dc=temple,dc=edu" credentials=password keepalive=0:5:0 tls_reqcert=allow searchbase="dc=temple,dc=edu" scope=sub schemachecking=on type=refreshAndPersist retry="5 5 5 +" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" logbase=cn=accesslog syncdata=accesslog olcSyncrepl: {1}rid=307 provider=ldaps://pre-ldapr17.temple.edu bindmethod=simple binddn="cn=replicator,dc=temple,dc=edu" credentials=password keepalive=0:5:0 tls_reqcert=allow searchbase="dc=temple,dc=edu" scope=sub schemachecking=on type=refreshAndPersist retry="5 5 5 +" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" logbase=cn=accesslog syncdata=accesslog olcSyncrepl: {2}rid=308 provider=ldaps://pre-ldapr18.temple.edu bindmethod=simple binddn="cn=replicator,dc=temple,dc=edu" credentials=password keepalive=0:5:0 tls_reqcert=allow searchbase="dc=temple,dc=edu" scope=sub schemachecking=on type=refreshAndPersist retry="5 5 5 +" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" logbase=cn=accesslog syncdata=accesslog - replace: olcMirrorMode olcMirrorMode: TRUE You really see this far down? Awesome! Maybe there's somethig that jumped out at you as wrong with this? Thanks for any help, Zach

2 1

Mirrormode activ server
by Stefan Kania 24 Jan '20

24 Jan '20

Hi, maybe I can't find it or I forgot it :-), but is there a way to find out which of my two servers in a mirrormode setup is active and which one is passive? Thanks for any hint Stefan

2 2

Making changes to olc configuration
by Prentice Bisbal 23 Jan '20

23 Jan '20

Thanks to your help, I've discovered I need to increase the size of my mdb MaxSize. I created the following LDIF file to increase it by a factor of 10: dn: olcDatabase={1}mdb,cn=config changetype: modify add: olcDbMaxSize olcDbMaxSize: 104857600 Now I can make changes to the LDAP directory itself, but when I try to make changes to the OLC data, like this change, I get an Insufficient access error: $ ldapmodify -v -f mdb.ldif add olcDbMaxSize: 104857600 modifying entry "olcDatabase={1}mdb,cn=config" ldap_modify: Insufficient access (50) How can I overcome this and give myself access to make these changes in the future? In the past I was advised to do a slapcat of the OLC database, make my changes, and then do a slapadd of the modified LDIF file.. Unfortunately, I forget details of that magical incantation, and I'd also like to make so I have the necessary privileges to make these changes in the future through LDIF changes like the one above. All you help is greatly appreciated. I know these answers are probably in the manual, and "RTFM" might be justified, but I'm a little under the gun trying to get a formerly working system up and running again, and I still haven't fully grasped OLC yet. -- Prentice

2 1

LMDB: "non-cached" reads
by Dmitri Shubin 22 Jan '20

22 Jan '20

Hi, Our application uses LMDB and sometimes we need to perform scan of old ("cold") data. The problem here is that this data can/will remove "hot" data from page-cache. Ideally to prevent this from happening we'd like to somehow mark cursor as "streaming"/"non-temporal". But AFAICS there is no such feature currently. We're experimenting with marking pages returned by cursor with madvise(MADV_DONTNEED) and this at least prevents RSS from growing. But maybe there are some downsides of this approach? Thanks! -- ______________________________ itiviti.com <https://www.itiviti.com/> <https://www.linkedin.com/company/itiviti> Follow Itiviti on Linkedin <https://www.linkedin.com/company/10438325/> The information contained in or attached to this email is strictly confidential. If you are not the intended recipient, please notify us immediately by telephone and return the message to us. Email communications by definition contain personal information. The Itiviti group of companies is subject to European data protection regulations. Itiviti’s Privacy Notice is available at www.itiviti.com <http://www.itiviti.com/>. Itiviti expects the recipient of this email to be compliant with Itiviti’s Privacy Notice and applicable regulations. Please advise us immediately at dataprotectionteam(a)Itiviti.com if you are not compliant with these.

2 2

Re: [External] Re: Replication suddenly broken
by Prentice Bisbal 22 Jan '20

22 Jan '20

On 1/16/20 8:05 PM, Quanah Gibson-Mount wrote: > > --On Thursday, January 16, 2020 9:03 PM +0000 Prentice Bisbal > <pbisbal(a)princeton.edu> wrote: > >> One of my coworkers just noticed that replication is broken between our >> primary and secondary LDAP servers. It appears to have been broken for >> about 1 week now. Nothing has changed relative to the LDAP configuration >> on either of our servers, so this is an odd thing to suddenly happen. >> When I look at the consumer with some debugging on, I see these messages >> (/usr/sbin/slapd -d 1638 was used to get these messages): >> >> It looks like the consumer >> host/voltron-b.pppl.gov,cn=pppl.gov,cn=gssapi,cn=auth,is being rejected >> as not being authorized, but this has been working for years w/o issue. >> Any idea what has changed and how I may fix it? > > Well, the error came from cyrus-sasl rather than OpenLDAP. This would > indicate to me that the not authorized came from the KDC. Have you checked > to ensure the keys in the keytab file haven't expired inside the KDC? > That's exactly what I suspected. We're using AD for our Kerberos Client, and one of our AD admins insists that it couldn't be expired credentials. I did use a utility called msktutil to make sure the kerberos tickets in /etc/krb5.keytab were up to date, but I'm still getting that error. Any ideas on how to prove/disprove what you suggest, so I can go back to my AD admins with more information? -- Prentice

3 5

mdb_put failed: MDB_MAP_FULL
by Prentice Bisbal 21 Jan '20

21 Jan '20

I've temporarily fixed my Kerberos problem (I think) by using k5start to start slapd in debug mode: k5start -f /etc/krb5.keytab host/voltron-b.pppl.gov -- /usr/sbin/slapd -d 1634 When I do this, I no longer see the SASL auth failures, but now I'm seeing this error. Does this mean there are too many members in the group "trbatch"? mdb_id2entry_put: mdb_put failed: MDB_MAP_FULL: Environment mapsize limit reached(-30792) "cn=trbatch,ou=groups,dc=unix,dc=pppl,dc=gov" 5e27700b null_callback : error code 0x50 5e27700b syncrepl_entry: rid=001 be_modify failed (80) sasl_generic_write: want=71, written=71 -- Prentice

2 1

implementing changlog in openldap
by nomit babraa 21 Jan '20

21 Jan '20

Hi We are using open ldap (sorry don't have access to the version at the moment) and were wondering if there is any support for creating a changelog that is available at cn=changelog? We have a third party system that could use this changelog for monitoring event driven changes and I've had difficulty googling anything that sounds officially supported? Thanks for any advice. n

2 1

consistency expectations for 3 node multimaster deltasyncrepl
by Zach Hanson Hart 18 Jan '20

18 Jan '20

Hello list, TL;DR With multimaster deltasyncrepl, when the cluster is partitioned (no replication) and conflicting values are added to an entry for a single-valued attribute, after the nodes are reconnected and replication commences, is it expected for all nodes to end up with the same value for the attribute, or is it expected that they may be inconsistent? The long version: I'm following test063-delta-multimaster in a local test cluster, with 3 master nodes, and I wanted to confirm that I'm not misunderstanding before moving forward. The test test063-delta-multimaster breaks replication and does conflicting adds of a single-valued attribute (employeeNumber) with different values on the two nodes. It then restores replication, gives it a bit to replicate, and then confirms that the "filtered" ldif is the same. My confusion is about this filtering. In the test, it does $LDIFFILTER -s a < $TESTDIR/server$n.out > $TESTDIR/server$n.flt and then compares the filtered files. Does this simply sort the attributes and values, or does it strip values? Essentially, is this testing that the value of the employeeNumber is the same on both nodes, or is it simply testing that the employeeNumber is present on both nodes? Thanks! Zach

2 1

Re: two slapd processes accessing one MDB env
by Ondřej Kuzník 17 Jan '20

17 Jan '20

On Fri, Jan 17, 2020 at 11:07:01AM +0100, Ondřej Kuzník wrote: > On Thu, Jan 16, 2020 at 04:08:28PM +0100, Michael Ströder wrote: > > HI! > > > > I vaguely remember that it's possible that two slapd processes can > > access a single MDB env. > > > > Is that supported? > > Any pre-cautions needed? > > I think if you were to configure both of them as a syncrepl consumer, > that might cause some headaches? (reply to list this time) Also if either of them is a syncrepl provider, probably make sure that no other server is accepting writes to this db file, I can imagine (refreshAndPersist) scenarios that might leave you unhappy otherwise. -- Ondřej Kuzník Senior Software Engineer Symas Corporation http://www.symas.com Packaged, certified, and supported LDAP solutions powered by OpenLDAP

2 2

direct MDB access for counting entries from Python
by Michael Ströder 17 Jan '20

17 Jan '20

HI! In my monitoring check I'd like to indicate how many entries are in a database. Currently I'm using the no-op search control without any filtering to count the entries which is obviously a huge waste of CPU and I/O ressources for just retrieving the raw number of DB entries. Is it easily possible to access the id2e sub-DB and query number of entries? Something like mdb_stat -s id2e -e <db-path> | grep Entries but from Python with python-lmdb or a similar module. (Yes, I know subprocess module but I really hate invoking command-line tools from Python.) Ciao, Michael.

2 5

Question about OpenLDAP and rwm overlay
by Vandenburgh, Steve Y 17 Jan '20

17 Jan '20

I'm attempting to use OpenLDAP as a proxy to an Active Directory domain. Using the ldap backend, I'm able to configure the proxy and that configuration seems to be working well. But account entries are frequently moved from ou to ou in a domain and Microsoft permits the bind DN to be a userPrincipalName attribute value of the entry instead of the full DN of the account; this features avoids having to make many bind DN application configuration changes. With just the ldap backend configured, OpenLDAP rejects the userPrincipalName (UPN) bind DN as an invalid DN. To work around this error, I was trying to see if I could use the rwm overlay to detect the UPN and convert to the actual domain entry DN using an attribute map. If I use the form mail=UPN the map works as expected; however, if I only provide the UPN as the bind DN, OpenLDAP still rejects it as an invalid DN. I suspect that the rwm overlay manipulations to not take effect until after the bind DN syntax is checked. I wanted to confirm my suspicion and see if any one else has been able to get a UPN-based bind to work through OpenLDAP. For reference my slapd.conf configuration is below: ### Schema includes ########################################################### include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema ## Module paths ############################################################## modulepath /usr/lib64/openldap/ moduleload rwm # Main settings ############################################################### loglevel 8 sizelimit unlimited idletimeout 600 writetimeout 30 allow bind_v2 pidfile /var/openldap/mycompany/var/slapd.pid argsfile /var/openldap/mycompany/var/slapd.args logfile /var/openldap/mycompany/logs/access TLSCertificateFile /var/openldap/mycompany/certs/Server.pem TLSCertificateKeyFile /var/openldap/mycompany/certs/Server.key TLSCACertificateFile /var/openldap/mycompany/certs/ServerCA.pem ### Rewrite rules ############################################################# # Bind with UPN instead of full DN: we first need # an ldap map that turns attributes into a DN (the # argument used when invoking the map is appended to # the URI and acts as the filter portion) overlay rwm rwm-suffixMassage "" "dc=mycompany,dc=com" rwm-rewriteMap ldap attr2dn "ldaps://mycompany.com/ou=Domain%20Users,dc=mycompany,dc=com?dn?sub" bindwhen=now version=3 binddn="CN=mybindacct,ou=Domain Users,DC=mycompany,DC=com" credentials=****** # Then we need to detect UPN DN # note that the rule in case of match stops rewriting # In case we are mapping virtual # to real naming contexts, we also need to rewrite # regular DNs, because the definition of a bindDN # rewrite context overrides the default definition. rwm-rewriteContext bindDN rwm-rewriteRule "^[^=,]+(a)mycompany.com$" "mail=$0" ":" rwm-rewriteRule "^mail=[^,]+(a)mycompany.com$" "${attr2dn($0)}" ":@" ### Database definition (Proxy to AD) ######################################### database ldap readonly yes protocol-version 3 rebind-as-user uri "ldaps://mycompany.com" suffix "dc=mycompany,dc=com" Thanks, Steve Vandenburgh This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

6 9

Replication suddenly broken
by Prentice Bisbal 17 Jan '20

17 Jan '20

One of my coworkers just noticed that replication is broken between our primary and secondary LDAP servers. It appears to have been broken for about 1 week now. Nothing has changed relative to the LDAP configuration on either of our servers, so this is an odd thing to suddenly happen. When I look at the consumer with some debugging on, I see these messages (/usr/sbin/slapd -d 1638 was used to get these messages): It looks like the consumer host/voltron-b.pppl.gov,cn=pppl.gov,cn=gssapi,cn=auth,is being rejected as not being authorized, but this has been working for years w/o issue. Any idea what has changed and how I may fix it? ldap_write: want=22, written=22 0000: 30 14 02 01 02 60 0f 02 01 03 04 00 a3 08 04 06 0....`.......... 0010: 47 53 53 41 50 49 GSSAPI ldap_read: want=8, got=8 0000: 30 4a 02 01 02 61 45 0a 0J...aE. ldap_read: want=68, got=68 0000: 01 0e 04 00 04 1c 53 41 53 4c 28 30 29 3a 20 73 ......SASL(0): s 0010: 75 63 63 65 73 73 66 75 6c 20 72 65 73 75 6c 74 uccessful result 0020: 3a 20 87 20 05 04 05 ff 00 0c 00 00 00 00 00 00 : . ............ 0030: 3a f9 e0 c9 07 00 00 00 fd e6 0d 82 df 31 29 00 :............1). 0040: a7 27 90 6a .'.j ldap_write: want=116, written=116 0000: 30 72 02 01 03 60 6d 02 01 03 04 00 a3 66 04 06 0r...`m......f.. 0010: 47 53 53 41 50 49 04 5c 05 04 04 ff 00 0c 00 00 GSSAPI.\........ 0020: 00 00 00 00 36 3c fc 1d 04 ff ff ff 64 6e 3a 75 ....6<......dn:u 0030: 69 64 3d 68 6f 73 74 2f 76 6f 6c 74 72 6f 6e 2d id=host/voltron- 0040: 62 2e 70 70 70 6c 2e 67 6f 76 2c 63 6e 3d 70 70 b.pppl.gov,cn=pp 0050: 70 6c 2e 67 6f 76 2c 63 6e 3d 67 73 73 61 70 69 pl.gov,cn=gssapi 0060: 2c 63 6e 3d 61 75 74 68 c2 5d 9b 4a ce d9 d6 8b ,cn=auth.].J.... 0070: 23 5f b4 1d #_.. ldap_read: want=8, got=8 0000: 30 3c 02 01 03 61 37 0a 0<...a7. ldap_read: want=54, got=54 0000: 01 32 04 00 04 30 53 41 53 4c 28 2d 31 34 29 3a .2...0SASL(-14): 0010: 20 61 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 66 authorization f 0020: 61 69 6c 75 72 65 3a 20 6e 6f 74 20 61 75 74 68 ailure: not auth 0030: 6f 72 69 7a 65 64 orized 5e20cedc slap_client_connect: URI=ldap://ldap1.pppl.gov ldap_sasl_interactive_bind_s failed (50) ldap_write: want=7, written=7 0000: 30 05 02 01 04 42 00 0....B. 5e20cedc do_syncrepl: rid=001 rc 50 retrying -- Prentice

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical