openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

-DLDAP_USE_NON_BLOCKING_TLS (was: OpenLDAP 2.4.50 available)
by Michael Ströder 29 Apr '20

29 Apr '20

On 4/28/20 7:16 PM, project(a)openldap.org wrote: > OpenLDAP 2.4.50 is now available for download as detailed on our download page: Building with -DLDAP_USE_NON_BLOCKING_TLS now fails. It worked with 2.4.49. Ciao, Michael. --------------------------------------------- cc -g -O0 -DNDEBUG -DSLAP_SCHEMA_EXPOSE -DLDAP_COLLECTIVE_ATTRIBUTES -DSLAP_CONFIG_DELETE -DLDAP_USE_NON_BLOCKING_TLS -Wl,-R/usr/lib -Wl,-R/usr/lib -Wl,-R/usr/lib -Wl,-R/usr/lib -o .libs/apitest apitest.o -L/usr/lib ./.libs/libldap.so /home/michael/src/openldap-git/re24/openldap/libraries/liblber/.libs/liblber.so ../../libraries/liblber/.libs/liblber.so ../../libraries/liblutil/liblutil.a -lsasl2 -lssl -lcrypto -lcrypt -lresolv -Wl,--rpath -Wl,/opt/openldap-re24/lib64 /usr/lib64/gcc/x86_64-suse-linux/9/../../../../x86_64-suse-linux/bin/ld: ./.libs/libldap.so: undefined reference to `Debug1' /usr/lib64/gcc/x86_64-suse-linux/9/../../../../x86_64-suse-linux/bin/ld: ./.libs/libldap.so: undefined reference to `Debug3' collect2: error: ld returned 1 exit status make[2]: *** [Makefile:309: apitest] Error 1 make[2]: Leaving directory '/home/michael/src/openldap-git/re24/openldap/libraries/libldap' make[1]: *** [Makefile:296: all-common] Error 1 make[1]: Leaving directory '/home/michael/src/openldap-git/re24/openldap/libraries' make: *** [Makefile:312: all-common] Error 1

2 1

Can't delete olcAccess entries
by Gao 28 Apr '20

28 Apr '20

Hello, I am using OpenLDAP 2.4.40 on CentOS 7.6. I tried to remove 2 ACL entries and failed. I must missed something so please help me. I now have: dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=van,dc=company,dc=com olcRootDN: cn=Manager,dc=van,dc=company,dc=com olcRootPW:: e1NTSEF9cEpWbEIzOEh4UXJpcjNVSUl2enZz0sm1akt4Nnd6OTk= olcDbIndex: objectClass eq,pres olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: loginShell eq olcDbIndex: uid eq,pres,sub olcDbIndex: memberUid eq,pres,sub olcDbIndex: uniqueMember eq,pres olcDbIndex: sambaSID eq olcDbIndex: sambaPrimaryGroupSID eq olcDbIndex: sambaGroupType eq olcDbIndex: sambaSIDList eq olcDbIndex: sambaDomainName eq olcDbIndex: default sub structuralObjectClass: olcHdbConfig entryUUID: 3b7e5722-d26f-1035-8835-91213c5bb357 creatorsName: cn=config createTimestamp: 20160629180122Z olcAccess: {0}to attrs=userPassword by self write by anonymous auth by dn.ba se="cn=Manager,dc=van,dc=company,dc=com" write by * none olcAccess: {1}to * by self write by dn="cn=Manager,dc=van,dc=company,dc= com" write by * read entryCSN: 20200427230612.038641Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20200427230612Z Then I created a LDIF file: # cat delete_acl.ldif dn: olcDatabase={2}hdb,cn=config changetype: modify delete: olcAccess olcAccess: {0} olcAccess: {1} Now try to delete the ACL: # ldapmodify -Y EXTERNAL -H ldapi:/// -f delete_acl.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={2}hdb,cn=config" # When I check with "slapcat -n 0" I see the 2 olcAssess entires is still exist. Please help. Thanks. Gao

3 3

dn with space space in olcRefintNothing
by Sébastien Chaumat 24 Apr '20

24 Apr '20

Hello, When configuring refint on slapd 2.4.49 the following is accepted : dn: olcOverlay={2}refint,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcRefintConfig olcOverlay: {2}refint olcRefintAttribute: seeAlso olcRefintNothing: cn=admin,dc=test but olcRefintNothing: cn=admin space,dc=test is rejected when I ldapadd the configuration with the message : ldap_add: Constraint violation (19) additional info: <olcRefintNothing> extra cruft after <string> I tried various quoting : cn="admin space",dc=test cn=admin\20space "cn=admin space" Do I miss something ? THX Sébastien

2 1

Re: Openldap Master-Slave setup
by Quanah Gibson-Mount 24 Apr '20

24 Apr '20

--On Thursday, April 23, 2020 9:41 PM -0700 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > olcDatabase={2}bdb,cn=config: BDB is deprecated. I'd advise using a non-deprecated backend. > olcReadOnly: TRUE > olcSyncrepl: {0}rid=001 provider=ldap://10.126.0.21:10389/ > binddn="cn=manager,dc=example,dc=com" bindmethod=simple > credentials=TopSecret searchbase="dc=example,dc=com" attrs="*,+" > type=refreshAndPersist retry="60 1 300 12 7200 +" timeout=1 > olcUpdateRef: ldap://10.126.0.21:10389 > olcMirrorMode: TRUE Is it a consumer or a multimaster node? You have enabled multiprovider (which is horribly misnamed as "mirrormode", and really just means you're defining it as part of a multiprovider cluster). > Chain overlay on frontendDB: > > > dn: olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config > objectClass: olcOverlayConfig > objectClass: olcChainConfig > olcOverlay: {0}chain > olcChainReturnError: TRUE > > dn: > olcDatabase={0}ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config > objectClass: olcLDAPConfig > objectClass: olcChainDatabase > olcDatabase: {0}ldap > olcDbURI: ldap://10.126.0.21:10389/ > olcDbIDAssertBind: bindmethod=simple > binddn="cn=manager,dc=example,dc=com" credentials=TopSecret mode=self > olcDbRebindAsUser: TRUE Why would chaning on the frontend database affect the ability of your dc=example,dc=com database to forward updates? You've clearly misconfigured your system. > So with the above config, if i add entry in master it is replicating to > slave but when i try to add entry in slave its not allowing write as > expected but its not forwarding request to referral ( its because of > ldapadd doesnt follow referral) is it expected? How do i make sure if > updatereferral is working properly? Configure your system correctly? You may also want to examine test032 in the test suite which specifically configures this. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Specific outgoing IP for syncrepl
by Dale Thompson - NOAA Federal 24 Apr '20

24 Apr '20

I've been using openldap's multi-master syncrepl based sync for years and it works great. But, I would like to be able to specify which IP on a multi-IP system syncrepl makes outgoing connections to other members of the sync cluster. On my multi-IP servers I am able to get slapd to only bind to a specific IP with the appropriate -h option. That works fine. But, outgoing syncrepl connections come from the primary IP on the server. Can anyone suggest a way to specify which IP syncrepl will use to make outgoing replication queries? -- Dale James Thompson, NWS Radar Operations Center IT Specialist, Configuration Management Team 1313 Halley Circle Norman, OK 73069 Voice (405) 573-3472 Fax (405) 573-3480 Dale.J.Thompson(a)noaa.gov

3 3

Re: Openldap Master-Slave setup
by Quanah Gibson-Mount 23 Apr '20

23 Apr '20

--On Thursday, April 23, 2020 10:45 AM -0700 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > > Quanah, > > > Thanks for quick response, with the above configuration does ldapadd on > slave through referral error message? We configured referral in slave > but when we did ldapadd its not throwing referral error but just > accepting the request, is it expected? i read in some other post where > user get below error in case of referral configured. I don't know what you were reading or if it's even related to OpenLDAP. As I said, it's up to clients to follow referrals if one is returned. The ldap* clients do not follow referrals. If you want the consumer to forward updates to the provider on the writer's behalf, then you need to configure chaining as I already stated. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Openldap Master-Slave setup
by Quanah Gibson-Mount 23 Apr '20

23 Apr '20

--On Thursday, April 23, 2020 9:11 AM -0700 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > Any idea? If this is not the right way to do, can you please point me to > a correct procedure? It is on clients to follow referrals if they are returned. If you want the consumer to forward the updates to the provider, then you need to configure chaining. man slapo-chain(5). Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: argon2, available as of what release?
by bitsof info 21 Apr '20

21 Apr '20

awesome, when might that be out? On Tue, Apr 21, 2020 at 1:34 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Tuesday, April 21, 2020 1:28 PM -0700 Quanah Gibson-Mount > <quanah(a)symas.com> wrote: > > > It will be a part of the 2.5 release series. However, I believe Ryan has > > backported it to 2.4 for the Debian builds. > > I just discussed with Howard, we'll be adding it to the 2.4.50 release. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

argon2, available as of what release?
by bitsof info 21 Apr '20

21 Apr '20

Hi, Trying to follow as of what OpenLdap release is the argon2 support made available? Looking here it looks like it was originally committed 3 years ago w/ recent updates 5 months ago: https://git.openldap.org/openldap/openldap/-/commits/af5ed7c6e27d596dbed440… But here in releases I don't see it mentioned: https://www.openldap.org/software/release/changes.html What minimum version of OpenLdap should I be running to have the argon2 support w/ the latest commit mentioned here? https://git.openldap.org/openldap/openldap/-/commit/af5ed7c6e27d596dbed440c… >= 2.4.45 for argon2 support? >= 2.4.49 for argon2 support w/ libsodium changes? also anyone know of a centos 7 package w/ all these pw contrib (argon2) module already built in it? thanks

2 2

RE: [External] RE: Problem using ldapsearch across forests with trust
by Quanah Gibson-Mount 17 Apr '20

17 Apr '20

--On Thursday, April 16, 2020 11:37 PM +0000 "Kleber S. Carvalho" <kleber.s.carvalho(a)avanade.com> wrote: > Hello, Quanah! > > I really appreciate your engagement in this case. > > Please help me understand if the client can validate the AD scenario with > the ldapsearch tool or not, or if ldapsearch is not supported in the > forest. You might need to see what options the Java program is using. For example, is it following referrals? Again, AD is not LDAP and so what you're talking about is really not LDAP related. There are no "forests" in LDAP, etc. Please stop CCing bugs(a)openldap.org Please don't send attachments to openldap-technical (your emails get dropped if you do). --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical