openldap-technical

openldap-technical@openldap.org

14 participants
9795 discussions

help needed for further investigation
by Thomas.Meller＠t-systems.com 07 Mar '19

07 Mar '19

Hello together. I am the heir of a setup based on RHEL 6.10 and Openldap 2.4.45 (ltb) A master syncrepls to a slave in type=refreshOnly using bindmethod=sasl, saslmech=external. The mapped techuser resides in ou=ServiceUser. All Clients also use user objects in the same ou to bind to the servers. I need to set new acls and decided to include a dedicated acl- and limits-configfile. The ACLs checked via slapacl look fine and run without problems on the test environment. (Which is based on the same 2.4.45 rpms, but the replica runs on RHEL 7.5) All slapd configuration make use of database mdb and an explicitly set maxsize. (which is sized sufficiently: 12 GB, 49 MB used) When implementing the configuration on a running system, the replica deletes the ou (that one with all the service user objects). Which is not what I want 8-/ How can I find out more about the reason for this peculiar result? I set the loglevel to 'stats sync' on the replica and 'sync' on the master. (fs size is limited for logs) The access limits are in place for this replication account and read access is granted as well. (might be I need to set something extra for operational attributes?) limits dn.subtree="ou=ServiceUser,..." size=unlimited (this is the replica) sizelimit unlimited timelimit 10 and limits dn.subtree="ou=ServiceUser,..." size=unlimited time=120 (in this order, this is the master) What do I need to look at to find what's missing? I am no openldap crack, but no newbie as well. Yet my openldap knowledge ist not very extended. Which further infos do I need to supply to maybe get help? The include statements for limits and acls are defined before the database configuration. I avoid using dynamic configuration to keep it all simple. Overlays in use: chain dynlist valsort memberof ppolicy (replica) syncprov ppolicy unique dynlist memberof refint valsort (master) Thank you, Thomas

3 4

setting up openldap to proxy to AD on SUSE ENT 12
by N6Ghost 06 Mar '19

06 Mar '19

hi all, I am trying to setup an openldap proxy to AD and i need to use SUSE Enterprise Linux 12. Hostname:/etc/openldap # rpm -qa|grep -i openldap openldap2-2.4.41-18.43.1.x86_64 openldap2-client-2.4.41-18.43.1.x86_64 what I am trying to do, is proxy an application (with 1000s of users) from talking directory to AD, to talking to openldap. and then have openldap talk to AD. look across the net is a bunch of stuff, but most of it does not seem to apply, or work. look at the offical doc, says use sasl but you must have an local entry with a {sasl] tag on the user thats not really ideal and work make a huge problem. a few of the posts online just said point to AD via ldap is possible? and this application also has a group lookup as part of its auth process... eg, only member of groupX can access.... any help in this would be huge. seems, i am mixing up a few different ways of doing this whats the bets way to do this? Thanks -N6ghost

5 7

Integer keys - order
by Sam Dave 01 Mar '19

01 Mar '19

When using integer keys (MDB_INTEGERKEY), is it guaranteed that when using mdb_cursor_get() to "loop through" my entire database, I will get the keys in the expected integer order? I thought I'd ask to be sure because I'm not sure if this expected behavior is documented.

1 0

Integer keys - drawbacks
by Sam Dave 01 Mar '19

01 Mar '19

Are there any known drawbacks to using integer keys (MDB_INTEGERKEY), performance or otherwise?

1 0

back-ldap timeout per operation
by Abdelkader Chelouah 01 Mar '19

01 Mar '19

Hello, I'm trying to figure out what is the behavior of back-ldap when the timeout (olcDbTimeout) is exceeded for a given operation ? Is the operation retried or aborted ?

1 0

Expected operation of pwdFailureCountInterval
by Tom Jay 27 Feb '19

27 Feb '19

Hello, Can someone explain the expected operation of the pwdFailureCountInterval attribute please? The documentation seems to be fairly clear, but if I add it to the password policy, along with some other attributes, the account remains locked, even after the pwdFailureCountInterval time. Despite authenticating with a valid password, the pwdFailureTime entries remain and the account remains locked. These are the attributes in use: pwdLockout: TRUE pwdMaxFailure: 5 pwdFailureCountInterval: 1200 Thanks. Tom

2 1

slapd-sock Overlay gives no RESULT on Successful BIND
by Kamal Advani 27 Feb '19

27 Feb '19

Hello, We are attempting to sync over some data from OpenLDAP into Win AD. The approach thus far has been to use slapd-sock in overlay mode and attach a listener. Our configuration snippet is as follows: --- moduleload back_sock overlay sock extensions connid socketpath /var/run/openldap/winad-sync-overlay.sock sockops add bind delete modify modrdn sockresps result --- What I have noticed is that on a successful BIND, no corresponding RESULT is received. However, on a BIND failure, we do, with a non-zero code (as expected). Another interesting situation is as follows: * On an unsuccessful BIND, we get 2 messages, a BIND and a MODIFY -- we also use the `ppolicy` module, so it sets the pwdFailureTime, an 'add' change, on a BIND failure. This is fine. * However, both the BIND and MODIFY have the same msgid. * Finally, we get one RESULT back with the same msgid. Continuing on, if I then BIND successfully, as above, I get: * BIND and MODIFY -- this time the MODIFY clears pwdFailureTime, a delete change. Same msgid on both BIND and MODIFY. * Again, only one RESULT, with the corresponding msgid. Have I misconfigured something, or is this expected behaviour? In all cases, have made sure I'm sending through CONTINUE after each message. I guess, I'd expect a RESULT for each request message, it would certainly make message processing much simpler and deterministic: * Receive request, store, keyed by conn id and msg id. * Receive RESULT, find corresponding request, and process accordingly. I only have this issue on BIND, as far as I can tell, at least for the `sockops` I'm interested in. Any suggestions are much appreciated. Thanks very much. Regards, Kamal PS. Happy to provide transcripts of output, just keeping the initial email size manageable. Please let me know. PPS. Another quirk is, it appears that I get a RESULT for a SEARCH, even though I am not subscribed to it in `sockops`, but happy to ignore this for now! -- There is more to life than increasing its speed. -- Mahatma Gandhi

1 0

Get values of Telephone Tab ( A.D. ) using ldapsearch.
by - - 26 Feb '19

26 Feb '19

Hi, I am trying to get the values of Telephone tab in a Active Directory Server using ldapsearch. http://www.windows-active-directory.com/telephone-tab-in-ad-user-properties… Active Directory User properties – Telephone tab<http://www.windows-active-directory.com/telephone-tab-in-ad-user-properties…> The telephone tab of the user properties window allows you to add detailed telephone contacts for the user. www.windows-active-directory.com I get other values like mail or telephoneNumber at the first tab but I can't get neither information of Telephone Tab . I am using this command: ldapsearch -x -H ldap://IP:PORT -D "cn=userldap,OU=users,DC=domain,DC=local" -w PASSWORD -b "DC=domain,DC=local" "(&(objectclass=person)(mail=user1(a)domain.com))" mail telephoneNumber mobile # extended LDIF # # LDAPv3 # base <DC=domain,DC=local> with scope subtree # filter: (&(objectclass=person)(mail=user1(a)domain.com)) # requesting: mail telephoneNumber mobile # # User 1, Users, domain.local dn: CN=User 1,OU=Users,DC=domain,DC=local l telephoneNumber: 1 mail: user1(a)domain.com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Is posible get this information using ldapsearch tool?. Thanks in advance . Best Regards

1 0

Help to understand "Paged results cookie is invalid"
by Andrea Patricelli 25 Feb '19

25 Feb '19

Good morning, I'm connecting to an OpenLdap through a JNDI client [1] and I "randomly" get this error: [LDAP: error code 2 - paged results cookie is invalid]; I suppose that the problem is related to multiple clients connecting to the LDAP with the same credentials (the same user), since the cookie is somehow related the user. Moreover since two different clients (different machines and IPs) are connecting simultaneously they invalidate the cookie to each other. Googling a bit and looking at the reference [1] and documentation I did not find something that confirm my thesis. Are my assumptions right or I'm misunderstanding the problem? If right, if there are multiple connections from the same client (same machine and IP) does OpenLdap manage this situation? I suppose (obviously) so, but asking anyway :) Thanks in advance, Andrea [1] https://github.com/Tirasa/ConnIdLDAPBundle/blob/net.tirasa.connid.bundles.l… [2] http://www.faqs.org/rfcs/rfc2696.html -- Dott. Andrea Patricelli Tel. +39 3204524292 Engineer @ Tirasa S.r.l. Viale Vittoria Colonna 97 - 65127 Pescara Tel +39 0859116307 / FAX +39 0859111173 http://www.tirasa.net Apache Syncope PMC Member

1 0

Forbidden account password reuse of the last 5 password
by Tian Zhiying 16 Feb '19

16 Feb '19

Hi Is there a feature that OpenLDAP password policy can forbidden user password reuse of the last 5 password? Thanks.

8 19

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical