openldap-technical

openldap-technical@openldap.org

14 participants
9795 discussions

what does "error 131 (State not recoverable)" indicate?
by James Anderson 30 May '20

30 May '20

good evening; i am looking for an explanation for a situation which we encountered with an lmdb database and library version is 0.9.17-3. the database's condition was such that all attempts to open it for reading failed. in at least some cases the error appears to have occurred during the operation which looked for stale leaders. a problem was also evident when attempting to copy the database: @nl12:~# mdb_copy /srv/dydra/catalog/repositories/d2141030-9495-c040-b1a7-9e19edbeb491/ /srv/dydra/backups/public-data__rev mdb_copy: copying failed, error 131 (State not recoverable) it was first evident in running processes which had already had the database open, but of which new threads were reopening the database environment. the only thing remarkable about the circumstances involved might have been that while several dozen threads were preparing reading simultaneously and in the processes of opening the environment to read, a monitoring thread took a snapshot of the threads, which entailed interrupting each to generate its stack trace. once we identified and terminated all processes which had the environment open, successive open attempts succeeded. when we examined the content, however, although the space was still occupied on disk and the transaction id reflected the prior content, the indices were empty. - what condition does that message intend to describe? - what can cause that condition? - would there have been some way to have recovered the old state - despite that message?

3 6

Antw: [EXT] LMDB does not recover on restart.
by Ulrich Windl 29 May '20

29 May '20

>>> Vipul Jain <vipul5798(a)gmail.com> schrieb am 28.05.2020 um 15:51 in Nachricht <15586_1590677913_5ECFD199_15586_106_1_CALsDq61nAgNh1Z3eUK=CNk_b7uWXgQ6aZYOzQvsn G-DPXQd2g(a)mail.gmail.com>: > In standalone application, I have insert 10 key,value using LMDB. > but if application crash and restart, and then I am trying to access the > same LMDB DB file, I am not able to see any data. it give error violating > memory access. Did the application commit the data before crash? > Any solution for this? > > I am looking for LMDB persistence, On restart of application do not need to > push key value again in LMDB. > > -- > with regards:- > Vipul Jain

2 1

LMDB does not recover on restart.
by Vipul Jain 28 May '20

28 May '20

In standalone application, I have insert 10 key,value using LMDB. but if application crash and restart, and then I am trying to access the same LMDB DB file, I am not able to see any data. it give error violating memory access. Any solution for this? I am looking for LMDB persistence, On restart of application do not need to push key value again in LMDB. -- with regards:- Vipul Jain

1 0

ReviewBoard LDAP authentication issue
by Adam Weremczuk 26 May '20

26 May '20

Hi all, I'm running old samba4 DC and trying to set up LDAP authentication for https://www.reviewboard.org/docs/manual/3.0/admin/configuration/authenticat… These settings are almost working for me: -> Authentication Method: LDAP -> LDAP Server: ldap://192.168.x.x:389 -> Review Board LDAP Bind Account: cn=auth,cn=Users,dc=domain,dc=co,dc=uk -> Review Board LDAP Bind Password: ******** -> LDAP Base DN: cn=Users,dc=domain,dc=co,dc=uk -> Username Attribute: uid -> Given Name Attribute: givenName -> Surname Attribute: sn -> Full Name Attribute: cn -> E-Mail LDAP Attribute: mail -> E-Mail Domain: (blank) -> Custom LDAP User Search Filter: (blank) I have a weird problem with about half of users being able to log in: 2020-05-26 11:32:07,623 - DEBUG - - root - Attempting to authenticate user DN "CN=dummy1,CN=Users,DC=domain,DC=co,DC=uk" (username dummy1) in LDAP and half unable: 2020-05-26 11:40:57,671 - ERROR - - root - Unexpected error authenticating user "dummy2" in LDAP: 'NoneType' object has no attribute 'decode' After ruling out the obvious such as AD groups membership and primary groups I compared ldapsearch dumps: ldapsearch -D 'admin(a)domain.co.uk' -b 'cn=Users,dc=domain,dc=co,dc=uk' -H ldap://192.168.x.x -W sAMAccountName=dummy I've noticed that all of those who cannot log in are missing msSFU30Name and msDS-SupportedEncryptionTypes attributes. I've added them to match settings for the successful users as below: dummy2.ldif dn: CN=dummy2,CN=Users,DC=domain,DC=co,DC=uk changetype: modify add: msSFU30Name msSFU30Name: dummy2 add: msDS-SupportedEncryptionTypes msDS-SupportedEncryptionTypes: 0 ldbmodify -H /var/lib/samba/private/sam.ldb dummy2.ldif -U dummy2 Modified 1 records successfully Unfortunately it didn't help :( Any ideas why? Thanks, Adam

1 0

replication issue. Incorrect ACL?
by Gao 20 May '20

20 May '20

Hello, We have two Openldap server in master-slave replication. I just found that a replication issue on the slave and I think it is ACL related. Few weeks ago I added ACL on the master (ldap-01) to allow user change their own password: dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap olcDbIndex: objectClass eq,pres olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: loginShell eq olcDbIndex: uid eq,pres,sub olcDbIndex: memberUid eq,pres,sub olcDbIndex: uniqueMember eq,pres olcDbIndex: sambaSID eq olcDbIndex: sambaPrimaryGroupSID eq olcDbIndex: sambaGroupType eq olcDbIndex: sambaSIDList eq olcDbIndex: sambaDomainName eq olcDbIndex: default sub structuralObjectClass: olcHdbConfig entryUUID: 3b7e5722-d26f-1035-7735-91213c5bb357 creatorsName: cn=config createTimestamp: 20160629180122Z olcSuffix: dc=van,dc=company,dc=com olcRootDN: cn=Manager,dc=van,dc=company,dc=com olcRootPW:: e1NTSEF9cEpWbEIzOEh4UXJpcjnvSUl2enZzWTF1akt4Nnd6OTk= olcAccess: {0}to attrs=userPassword by self write by anonymous auth by dn.ba se="cn=Manager,dc=van,dc=company,dc=com" write by * none olcAccess: {1}to * by self write by dn="cn=Manager,dc=van,dc=company,dc= com" write by * read entryCSN: 20200504150528.806636Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20200504150528Z Now I found on the slave(ldap-03) all userPassword attributes is disappeared. So I think the ACL may blocked the replication. I think I need add the replication user (rpuser) to the ACL on the master and allow the rpuser read(or RW?) access. Could someone check my ACL and see if my guess is correct? If so then how do I add (or append?) the ACL to allow replication of the userPassword? Thank you in advance. Gao

3 5

Antw: [EXT] Re: replication issue. Incorrect ACL?
by Ulrich Windl 20 May '20

20 May '20

>>> Andreas Hasenack <andreas(a)canonical.com> schrieb am 20.05.2020 um 15:04 in Nachricht <17575_1589979873_5EC52AE0_17575_76_1_CANYNYEHQ0+sBtbuO8zDKcaZChDxPPB6WC0tWabWWM yLgVtkYA(a)mail.gmail.com>: >> olcRootDN: cn=Manager,dc=van,dc=company,dc=com >> olcRootPW:: e1NTSEF9cEpWbEIzOEh4UXJpcjnvSUl2enZzWTF1akt4Nnd6OTk= > > You should change that password now, since you just shared its SSHA > hash to the world ;) ...what makes me wonder how long it takes these days to create a valid password from a salted SHA-1 hash... [...]

2 1

Disable overlays
by Jean-Luc Chandezon 18 May '20

18 May '20

Hello, I don't how to disable overlays (ppolicy or sync for example). Is it possible? Thanks, Jean-Luc

2 1

"GSSAPI Error: No credentials were supplied ... unknown mech-code 0 for mech unknown"
by Braiam 15 May '20

15 May '20

Hi, I'm trying to get slapd to use heimdal kerberos to provide a single authentication backend for my network. I've followed the Administrator's Guide on SASL[1] and cyrus faq entry about connecting OpenLDAP with GSSAPI[2]. I'm stuck at the what I believe is a misunderstanding from my part. I believe when I use -Y GSSAPI I should be using my braiam/admin credentials, but according to SASL facility in slapd I'm not providing any. strace confirms that it reads the /tmp/krb5cc_1000 file correctly. I'm very confused as to how to proceed since most of the relevant results point to having not kinit'd. I'm using Debian stable, slapd=2.4.47+dfsg-3+deb10u1, libsasl2-modules-gssapi-heimdal=2.1.27+dfsg-1+deb10u1. debian@ldap01:~$ sudo ktutil -k /etc/krb5.keytab list /etc/krb5.keytab: Vno Type Principal Aliases 4 aes256-cts-hmac-sha1-96 host/ldap01.example.com(a)EXAMPLE.COM 4 des3-cbc-sha1 host/ldap01.example.com(a)EXAMPLE.COM 4 arcfour-hmac-md5 host/ldap01.example.com(a)EXAMPLE.COM 9 aes256-cts-hmac-sha1-96 ldap/ldap01.example.com(a)EXAMPLE.COM 9 des3-cbc-sha1 ldap/ldap01.example.com(a)EXAMPLE.COM 9 arcfour-hmac-md5 ldap/ldap01.example.com(a)EXAMPLE.COM debian@ldap01:~$ klist Credentials cache: FILE:/tmp/krb5cc_1000 Principal: braiam/admin(a)EXAMPLE.COM Issued Expires Principal May 12 20:34:05 2020 May 13 20:34:05 2020 krbtgt/EXAMPLE.COM(a)EXAMPLE.COM May 12 20:34:11 2020 May 13 20:34:05 2020 ldap/ldap01.example.com(a)EXAMPLE.COM debian@ldap01:~$ ldapsearch -LLL -Y GSSAPI -s "base" -b "" supportedSASLMechanisms -H $ldap_host SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80) additional info: SASL(-1): generic failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible. (unknown mech-code 0 for mech unknown) [1]: http://www.openldap.org/doc/admin24/sasl.html [2]: https://www.cyrusimap.org/sasl/sasl/faqs/openldap-sasl-gssapi.html -- Braiam

3 4

Help for setting-up an ldap-proxy
by lists＠zxt10d.de 14 May '20

14 May '20

Hello, I'm pretty new to this list, and maybe/hopefully someone could help ... I work at a chair at a german university, and we would like to use the central AD of theat university for our chair - by using a ldap-proxy system, so that there's only one connection to the central AD, and not ~70 (all of our computers, etc.). I can search the AD by using this (modified) command: ldapsearch -LLL "(cn=FIRSTNAME LASTNAME)" -H ldaps://ldap.UNIVERSITY.de -b dc=university,dc=de -D cn=special,ou=group,dc=university,dc=de -W For locally installed applications I can use this /etc/pam_ldap.conf: uri ldaps://ldap.university.de host ldap.university.de base ou=group,ou=hosts,dc=university,dc=de ldap_version 3 binddn cn=special,ou=group,dc=university,dc=de bindpw password pam_password crypt ssl start_tls ssl on To set-up the local ldap-proxy, I tried to follow this description, but it won't work (and I guess its not realy correct, as the config-file is there twice): https://doc.owncloud.com/server/admin_manual/configuration/ldap/ldap_proxy_… When running "slaptest -f /etc/ldap/slapd.conf" I get these errors: 5ebd3ec5 /etc/ldap/slapd.conf: line 102: warning, source attributeType 'dn' should be defined in schema 5ebd3ec5 PROXIED attributeDescription "DN" inserted. 5ebd3ec5 hdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap: (2). Expect poor performance for suffix "ou=group,ou=hosts,dc=university,dc=de". 5ebd3ec5 hdb_db_open: database "ou=lsafp,ou=hosts,dc=university,dc=de": db_open(/var/lib/ldap/id2entry.bdb) failed: No such file or directory (2). 5ebd3ec5 backend_startup_one (type=hdb, suffix="ou=group,ou=hosts,dc=university,dc=de"): bi_db_open failed! (2) 5ebd3ec5 backend_startup_one (type=ldap, suffix="ou=group,ou=hosts,dc=university,dc=de"): bi_db_open failed! (2) slap_startup failed (test would succeed using the -u switch) Now my questions: - where and how to put the data to do a query versus the central AD? (binddn & bindpw part) - where to define the local ldap-database? (I guess that has to be created an will be filled automatically...?) The system I'm using is a Debian 10.4 one. slapd -V: @(#) $OpenLDAP: slapd (Apr 20 2020 18:19:54) $ Debian OpenLDAP Maintainers <pkg-openldap-devel(a)lists.alioth.debian.org> Sorry, english is not my native language ... Thanks a lot for reading! ;) Cheers, Torsten

1 0

Can't get LDAPS connection with OpenLDAP as a Proxy working (error:14090086)
by a.leurs＠consense-gmbh.de 13 May '20

13 May '20

Hello, I'm farely now to OpenLDAP. I have successfully build a connection to an Windows Active Directory with LDAP over Port 389. But when I switch to LDAPS and Port 636 and try a connection via the Softerra LDAP Browser I get the following error: TLS certificate verification: Error, unable to get local issuer certificate TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (unable to get local issuer certificate). I have installed the certificate of the Server I want to connect to on my machine. But I still get this error. Does anyone have an idea why this error happens? Here is my slapd.conf-File: # MDB Backend configuration file # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. ucdata-path ./ucdata include ./schema/core.schema include ./schema/cosine.schema include ./schema/nis.schema include ./schema/inetorgperson.schema #include ./schema/openldap.schema #include ./schema/dyngroup.schema pidfile ./run/slapd.pid argsfile ./run/slapd.args loglevel 256 sizelimit unlimited timelimit unlimited ####################################################################### # mdb database definitions ####################################################################### database meta suffix "dc=example,dc=com" uri "ldaps://dc001.example.com:636/DC=example,DC=com"

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical