openldap-technical

openldap-technical@openldap.org

9951 discussions

Issue with ignoring case on memberUid
by arun 06 Jun '18

06 Jun '18

Hi All, We are trying to use email IDs on memberUid attribute for groups and memberUid is not allowing case insensitive search for characters after @. We modified schema to ignore case but it's not working. Please let us know how do we use memberUid with case-insensitive characters. Ex: Abc.efh(a)Dummy.com is the memberUid attribute Ignore case search for ABC.efh(a)dummy.com doesn't work. Arun

2 1

Switching from bdb to lmdb with Openldap-2.4.46
by Saurabh Lahoti 05 Jun '18

05 Jun '18

Dear, How could we upgrade our bdb to mdb using slapadd..? ---- *Thanks & Kind Regards,* Saurabh LAHOTI.

4 3

Setting up syncrepl
by Fabiano Sidler 31 May '18

31 May '18

Hi folks! I'm trying to set up a working multi-master syncrepl. Both servers I can connect to (using Apache Directory Studio), but nothing is synced. Starting slapd with -d 16384 -d 32768 (sync + none) only produces the following logs on both servers: --- 5b0b0988 do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT 5b0b0988 do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT 5b0b0992 do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT --- This is my configuration: --- dn: cn=config objectClass: olcGlobal cn: config olcPidFile: /var/run/openldap/slapd.pid olcTLSCACertificateFile: /usr/local/etc/openldap/ca olcTLSCertificateFile: /usr/local/etc/openldap/crt olcTLSCertificateKeyFile: /usr/local/etc/openldap/key olcAuthzRegexp: {0}"gidNumber=0\+uidNumber=0,cn=peercred,cn=external,cn=auth" "cn=admin,$basedn" olcAuthzRegexp: {1}"uid=root,cn=$domain,cn=gssapi,cn=auth" "cn=admin,$basedn" olcAuthzRegexp: {2}"uid=dc(1|2),cn=$domain,cn=gssapi,cn=auth" "cn=admin,$basedn" olcServerID: 1 ldap://dc1.$domain/ olcServerID: 2 ldap://dc2.$domain/ olcSaslRealm: $domain olcLogLevel: 0 dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema include: file:///usr/local/etc/openldap/schema/core.ldif include: file:///usr/local/etc/openldap/schema/cosine.ldif include: file:///usr/local/etc/openldap/schema/inetorgperson.ldif include: file:///usr/local/etc/openldap/schema/dyngroup.ldif include: file:///usr/local/etc/openldap/schema/ppolicy.ldif include: file:///usr/local/etc/openldap/schema/nis.ldif include: file:///usr/local/etc/openldap/schema/hdb.ldif include: file:///usr/local/etc/openldap/schema/samba.ldif dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulePath: /usr/local/libexec/openldap olcModuleLoad: {0}back_mdb olcModuleLoad: {2}syncprov olcModuleLoad: {2}rwm olcModuleLoad: {3}back_relay #olcModuleLoad: {4}smbk5pwd dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcRootDN: $rootdn olcSyncrepl: {0}rid=001 provider=ldap://dc1.$domain/ bindmethod=simple binddn="cn=admin,$basedn" credentials="secret" searchbase="cn=config" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=002 provider=ldap://dc2.$domain/ bindmethod=simple binddn="cn=admin,$basedn" credentials="secret" searchbase="cn=config" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcSuffix: $basedn olcRootDN: cn=admin,$basedn olcDbDirectory: /var/db/openldap/$domain olcSyncrepl: {0}rid=004 provider=ldap://dc1.$domain/ bindmethod=simple binddn="cn=admin,$basedn" credentials="secret" searchbase="$basedn" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=005 provider=ldap://dc2.$domain/ bindmethod=simple binddn="cn=admin,$basedn" credentials="secret" searchbase="$basedn" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE dn: olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov --- What's the problem? Best wishes, Fabiano

1 0

Re: removing ppolicy overlay
by Frank Swasey 30 May '18

30 May '18

The lack of responses indicates that people either do not use ppolicy or once used, they never remove it. For future reference here's the procedure that I've worked up: shutdown slapd on all MMR members slapcat the database edit the database to remove all "pwd*" attributes and all entries that are pwd* objectClass edit the slapd.conf file (if you are using slapd.d you are on your own) replace the database (delete, and slapadd) Empty the accesslog database if you are using that start slapd Copy your edited database to the rest of your servers and use the tried and true "nuke & repave" process to delete the existing database, edit the config, slapadd the edited database - Frank > On Apr 16, 2018, at 11:09, Frank Swasey <Frank.Swasey(a)uvm.edu> wrote: > > Is there a recommended way to discontinue the use of the ppolicy overlay? > > The only way I've found that works is to stop the ldap server and using slapcat/edit/slapadd eradicate all the ppolicy attributes (combined with removing the ppolicy overlay and schema from the slapd.conf file). > > I'm attempting this on RHEL7 with OpenLDAP 2.4.46 (local built). > > Thanks, > - Frank

3 2

Duplicate Password Policies and Can Not Rest User Password
by Daniel Howard 30 May '18

30 May '18

Hello, I have two issues. One is I gave myself redundant *ppolicy* overlays I can't delete. The other is I don't know why I can not reset a user's password. The first is that in a rush, late at night, I ended up with multiple (duplicate) Password Policy Overlays. I went back and tried to delete these, but: $ *sudo ldapmodify -Q -Y EXTERNAL -H ldapi:///* dn: olcOverlay={5}ppolicy,olcDatabase={1}hdb,cn=config changetype: delete deleting entry "olcOverlay={5}ppolicy,olcDatabase={1}hdb,cn=config" ldap_delete: Server is unwilling to perform (53) It looks like this is a known consideration, per http://www.zytrax.com/books/ldap/ch6/slapd-config.html#use-overlays and that I'll have to cowboy the server config to get the redundant overlays removed. root@ldap0:~# *slapd -V* @(#) $OpenLDAP: slapd (Ubuntu) (May 31 2017 21:52:16) $ buildd@lgw01-30 :/build/openldap-tnOaja/openldap-2.4.31/debian/build/servers/slapd Okay, so what is that overlay? Pretty simple stuff: dn: olcOverlay={2}ppolicy,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: {2}ppolicy olcPPolicyDefault: cn=passwordDefault,ou=Policies,dc=qxxxxxxxxd,dc=com olcPPolicyHashCleartext: FALSE olcPPolicyUseLockout: FALSE olcPPolicyForwardUpdates: FALSE (But defined four times ... {2..5}) What is the problem, then? The problem is I can not set a user's password. root@ldap0:~# */usr/bin/ldappasswd -y /etc/ldapscripts/ldapscripts.passwd -D cn=admin,dc=qxxxxxxxxd,dc=com -x -H ldap://localhost -T /tmp/ldapsetpasswd uid=zachary,ou=People,dc=qxxxxxxxxd,dc=com* Result: No such attribute (16) Say what? dn: uid=zachary,ou=People,dc=qxxxxxxxxd,dc=com structuralObjectClass: account entryUUID: cd55cc80-f8a5-1037-976e-9da738d41e24 creatorsName: cn=admin,dc=qxxxxxxxxd,dc=com createTimestamp: 20180530223739Z pwdFailureTime: 20180530223741Z pwdFailureTime: 20180530224243Z pwdFailureTime: 20180530224244Z pwdFailureTime: 20180530224306Z pwdFailureTime: 20180530224307Z pwdFailureTime: 20180530224354Z pwdFailureTime: 20180530224538Z pwdFailureTime: 20180530224541Z entryCSN: 20180530224541.157285Z#000000#000#000000 modifiersName: cn=admin,dc=qxxxxxxxxd,dc=com modifyTimestamp: 20180530224541Z entryDN: uid=zachary,ou=People,dc=qxxxxxxxxd,dc=com subschemaSubentry: cn=Subschema hasSubordinates: FALSE Maybe the user is locked out? root@ldap0:~# *ldapmodify -Q -Y EXTERNAL -H ldapi:/// -D cn=admin,dc=qxxxxxxxxd,dc=com* dn: uid=zachary,ou=People,dc=qxxxxxxxxd,dc=com changetype: modify delete: pwdFailureTime modifying entry "uid=zachary,ou=People,dc=qxxxxxxxxd,dc=com" ldap_modify: Constraint violation (19) additional info: pwdFailureTime: no user modification allowed Q1: Any bright idea on removing the redundant ppolicy overlays? Q2: Any bright idea on what's up with resetting zachary's password? Thanks, -danny -- http://dannyman.toldme.com

1 0

MDB_INVALID: File is not an LMDB file
by Chris Trenkamp 30 May '18

30 May '18

My program suddenly started returning this error, "MDB_INVALID: File is not an LMDB file" whenever it tries to open the database file. It is running on Windows. I made a copy of the database, compiled lmdb with MDB_DEBUG set to 2 and ran this program: #include <stdio.h> #include "lmdb.h" int main(int argc, char* argv[]) { int rc; MDB_env *env; rc = mdb_env_create(&env); printf("%d\n", rc); rc = mdb_env_open(env, "./brokedb", 0, 0644); printf("%d\n", rc); } And it gave this output: 0 mdb_env_read_header:4040 page 0 not a meta page -30793 Does anyone know how this might have happened, and things to look for in my program that might have caused this? Is there a way to recover the data from the file? Thanks.

2 1

LDAP instance crashing frequently due to swap memory exhaustion
by Saurabh Lahoti 29 May '18

29 May '18

Dear, LDAP instance crashes frequently due to low or no swap memory. What could be the probable reasons for this crash..? ---- *Thanks & Kind Regards,* Saurabh LAHOTI.

1 0

search abandoned by pagedResult nentries=0
by jehan procaccia INT 25 May '18

25 May '18

Hello I have a software (zimbra) that request my openldap server regularly in order to update the "Global Address List" (for mail auto-completion) It request the openldap with a simple search filter after binding however, although it seems to start fine, the result ends with May 24 20:40:48 ldapmt slapd[16434]: conn=1003 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text=search abandoned by pagedResult size=0 nentries=0 and no result is returned I do see the request in the ldap logs May 24 20:40:48 ldapmt slapd[16434]: conn=1003 op=2 SRCH base="dc=telecom,dc=fr" scope=2 deref=3 filter="(|(mail=*)(sn=*))" If I do the exact same request (binddn, bindpassw, searchbase, ldapuri, scope, deref, filter) from the zimbra server itself, I do get a correct result with nentries=6505 I don't understand why when the zimbra software does the same request, it fails with nentries=0 text=search abandoned by pagedResult !? what is that message "search abandoned by pagedResult" means ? how can I further debug that problem ? ( I already set loglevel to acl filter stats ) Regards

1 0

.so version numbers for dlopen'd objects
by Paul B. Henson 23 May '18

23 May '18

I'm trying to get the OpenBSD openldap port updated to use modules, currently it just builds everything into a monolithic binary. They are objecting to the existence of the version number in the shared objects for the modules: -rwxr-xr-x 1 henson henson 1773576 May 21 12:54 back_bdb-2.4.so.2.10.7 -rwxr-xr-x 1 henson henson 864 May 21 12:54 back_bdb.la lrwxrwxrwx 1 henson henson 22 May 21 12:54 back_bdb.so -> back_bdb-2.4.so.2.10.7 They say that shared objects which are intended to be dlopen'd, as opposed to linked to, should not include version numbers, and it should look like: -rwxr-xr-x 1 henson henson 1773576 May 21 12:54 back_bdb-2.4.so -rwxr-xr-x 1 henson henson 864 May 21 12:54 back_bdb.la What is the openldap developer perspective on this? Thanks.

5 14

Understanding slapd connections
by Igor Zobin 22 May '18

22 May '18

Hello everyone! I am struggling to understand what exactly the command lsof -i tcp:389 is showing. What exactly is counted as an established connection here? Can I limit that amount somehow through slapd configuration? Can I monitor which of those connections shown by lsof are still in use and which just hang around doing nothing? Igor.

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical