openldap-technical

openldap-technical@openldap.org

18 participants
9897 discussions

Re: [Q] what is the best practice or right way to change schemas order for cn=config case?
by Howard Chu 21 Dec '17

21 Dec '17

Christian Kratzer wrote: > Hi, > > On Wed, 20 Dec 2017, Zeus Panchenko wrote: > >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> hi, >> >> what is the best practice or right way to change schemas order for cn=config >> case? Use ldapmodrdn. >> >> 1. to move file? >> 2. to ldapmodify? >> >> for the one used to slapd.conf both of ways look weird ... :( > > for those cases that ldapmodify that does not work you can use slapcat > to dump all of the cn=config database edit it and reimport using slapadd. > > Adding -n0 to slapadd and slapcat makes it use the cn=config database. > > Greetings > Christian > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: uidNumber for Service Accounts?
by Douglas Duckworth 19 Dec '17

19 Dec '17

Thanks John and everyone else. It's only performing binds for Apache, and sssd, as I do not allow anon binds to the LDAP server. This particular account does not perform any interactive logins on *Nix boxes. Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-6305 F: 212-746-8690 On Wed, Oct 25, 2017 at 9:18 PM, John Lewis <jl(a)hyperbolicinnovation.com> wrote: > On Wed, 2017-10-25 at 09:32 -0400, Douglas Duckworth wrote: > > Hi > > > > Do I need uidNumber for Service Accounts used for application / > > server binding if this user won't actually be resolved by sssd or > > nslcd? > > > > I set a very high uidNumber but eventually this will conflict with > > users as in my ignorance I didn't put this in a lower range. > > > > Thanks, > > > > Douglas Duckworth, MSc, LFCS > > HPC System Administrator > > Scientific Computing Unit > > Physiology and Biophysics > > Weill Cornell Medicine > > E: doug(a)med.cornell.edu > > O: 212-746-6305 > > F: 212-746-8690 > > It depends on weather your service account needs to login to a UNIX > compliant system or not. If the account doesn't have a uid, it will > most likely not be able to login as a standard UNIX account via LDAP. > > If the binds go directly to an application without going through an OS > authentication layer, for example a web user login, it probably doesn't > matter either way whether the account has a uidNumber set or not. If > you have an interaction with sssd or nslcd in the middle, you are going > to need the uidNumber attribute set. >

3 4

Re: use-case for clientctrls?
by Howard Chu 19 Dec '17

19 Dec '17

Michael Ströder wrote: > After so many years passing around parameter clientctrls (e.g. in a > wrapper module) I'm still wondering which use-cases this argument is > meant for. > > I only found [1] but this seems akward today anyway. Agreed, OID-based controls for client-side library behavior seems rather unwieldy. I would agree though, that per-request control of library behavior is a good thing. The C API still has no ldap_search() parameter for alias deref behavior. It's a bit ridiculous that it's a library-level option, since the option only has relevance to search requests. > Any more client controls? > > Ciao, Michael. > > [1] > https://tools.ietf.org/html/draft-ietf-ldapext-ldap-c-api-05#section-11.3.1 > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

use-case for clientctrls?
by Michael Ströder 18 Dec '17

18 Dec '17

After so many years passing around parameter clientctrls (e.g. in a wrapper module) I'm still wondering which use-cases this argument is meant for. I only found [1] but this seems akward today anyway. Any more client controls? Ciao, Michael. [1] https://tools.ietf.org/html/draft-ietf-ldapext-ldap-c-api-05#section-11.3.1

1 0

Database limit(s)
by Ervin Hegedüs 17 Dec '17

17 Dec '17

Hi there, I'ld like to ask, is there any hard or soft limit in database? I mean, how many object canbe stored in the DB? Or how many children object could under a parent? I've read the docs about the limits ( http://www.openldap.org/doc/admin24/limits.html), but there are only the sizelimit and timelimit (which aren't affected me now). In other words, which parameters do I check before I start to design a database (LDAP/non-LDAP (eg. OS) parameters)? Thanks, a.

2 1

Re: LMBD - If passing NULL to data parameter is legal in mdb_cursor_get()
by Howard Chu 16 Dec '17

16 Dec '17

Kaho Ng wrote: > Hi, > > When reading the documentation of lmdb, I wonder if the behavior in regards > to passing NULL as data parameter to mdb_cursor_get() is subject to changes. No. Unless there's an obvious bug, or the documentation specifically says "subject to change", existing behavior will not change. > When reading the source code of the library, I found that for some of the > operations, if NULL is passed as data parameter EINVAL will be returned, and > for the other operations passing will lead to different behavior > (for instance, MDB_SET). > > I am not sure if the behavior of future versions of lmdb will stay in > line with the > current version. Or is it generally illegal to pass NULL as data parameter? > > Could you give me some hints on that? Thank you. Ask yourself why you would ever pass NULL in each case and what that would mean. This is basic logic. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: slapd segfault in openldap 2.4.45
by Scott Koch 16 Dec '17

16 Dec '17

Correction, my openldap version is 2.4.45(typo'ed in previous post). On Wed, Dec 13, 2017 at 11:23 AM Scott Koch <scottkoch(a)gmail.com> wrote: > This is an RPM of openldap I built from the latest upstream source. This > slapd server is running on RHEL 7.4 x86_64. > > Error message: > 2017-12-13T00:13:34.944152-05:00 ldap1.example.com kernel: slapd[983]: > segfault at 766f6730 ip 00007f0272e2549b sp 00007f02017f55b8 error 4 in > libc-2.17.so[7f0272ce8000+1b8000] > > We have seen 15 or so instances of this issue and in all cases the last > LDAP operations follow the same pattern where there is an ABANDON and > UNBIND, then there is a SRCH operation. See log output below of full > connection for the client that performs the last operation. > > Let me know if there is any other information I can provide to help > troubleshoot this problem. > > Thanks in advance for the help! > -Scott > > 2017-12-13T00:13:03.560693-05:00 ldap1.example.com slapd[26514]: > conn=873638 fd=105 ACCEPT from IP=10.0.4.37:48520 (IP=0.0.0.0:389) > > 2017-12-13T00:13:03.560869-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=0 EXT oid=1.3.6.1.4.1.1466.20037 > > 2017-12-13T00:13:03.561012-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=0 STARTTLS > > 2017-12-13T00:13:03.561211-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=0 RESULT oid= err=0 text= > > 2017-12-13T00:13:03.569367-05:00 ldap1.example.com slapd[26514]: > conn=873638 fd=105 TLS established tls_ssf=256 ssf=256 > > 2017-12-13T00:13:03.569853-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=1 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" > > 2017-12-13T00:13:03.570014-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=1 SRCH attr=* altServer namingContexts supportedControl > supportedExtension supportedFeatures supportedLDAPVersion > supportedSASLMechanisms domainControllerFunctionality defaultNamingContext > lastUSN highestCommittedUSN > > 2017-12-13T00:13:03.570215-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= > > 2017-12-13T00:13:03.571953-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=2 SRCH base="dc=example,dc=com" scope=2 deref=0 > filter="(&(?objectClass=sudoRole)(|(!(?sudoHost=*))(?sudoHost=ALL)(?sudoHost= > node1713.example.com)(?sudoHost=node1713)(?sudoHost=10.0.4.37)(?sudoHost= > 10.134.0.0/18)(?sudoHost=ffff::ffff:ffff:fff:ffff)(?sudoHost=fe80::/64)(?sudoHost=+*)(|(?sudoHost=*\5C*)(?sudoHost=*?*)(?sudoHost=*\2A*)(?sudoHost=*[*]*))) > <http://10.134.0.0/18)(?sudoHost=ffff::ffff:ffff:fff:ffff)(?sudoHost=fe80::/…> > )" > > 2017-12-13T00:13:03.572214-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=2 SRCH attr=objectClass cn sudoCommand sudoHost sudoUser > sudoOption sudoRunAs sudoRunAsUser sudoRunAsGroup sudoNotBefore > sudoNotAfter sudoOrder modifyTimestamp > > 2017-12-13T00:13:03.573488-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text= > > 2017-12-13T00:13:34.943439-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=4 ABANDON msg=4 > > 2017-12-13T00:13:34.943694-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=3 SRCH base="dc=example,dc=com" scope=2 deref=0 > filter="(&(uid=ntp)(objectClass=posixAccount)(&(uidNumber=*)(!(uidNumber=0))))" > > 2017-12-13T00:13:34.943885-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=5 UNBIND > > 2017-12-13T00:13:34.944092-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=3 SRCH attr=objectClass uid userPassword uidNumber gidNumber > gecos homeDirectory loginShell krbPrincipalName cn modifyTimestamp > modifyTimestamp shadowLastChange shadowMin shadowMax shadowWarning > shadowInactive shadowExpire shadowFlag krbLastPwdChange > krbPasswordExpiration pwdAttribute authorizedService accountExpires > userAccountControl nsAccountLock host loginDisabled loginExpirationTime > loginAllowedTimeMap sshPublicKey mail >

2 1

Re: Database limit(s)
by Howard Chu 16 Dec '17

16 Dec '17

Ervin Hegedüs wrote: > Hi there, > > I'ld like to ask, is there any hard or soft limit in database? No. > I mean, how > many object canbe stored in the DB? Or how many children object could under a > parent? > > I've read the docs about the limits > (http://www.openldap.org/doc/admin24/limits.html), but there are only the > sizelimit and timelimit (which aren't affected me now). > > In other words, which parameters do I check before I start to design a > database (LDAP/non-LDAP (eg. OS) parameters)? > > Thanks, > > > a. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Openldap Password Reset Portal
by Douglas Duckworth 15 Dec '17

15 Dec '17

Hi I am looking for password reset portal where users can reset their credentials. We already have a legacy app written in php but it needs to be retired. I came across PWM which lists a number of schema changes that are required before it can work with openldap. https://github.com/pwm-project/pwm/wiki/General-Directory-Setup I have a few questions: 1) Has anyone used PWM and if so can you describe how stable it operates? I find the documentation lacking though it seems there's not a ton of issues on their Github site. 2) Has anyone found other solutions besides PWM that do the same thing?

3 3

PHP-LDAP added EXOP support with PHP 7.2
by Côme Chilliet 12 Dec '17

12 Dec '17

Hello, Some people on IRC thought this was worth mentioning here. PHP 7.2.0 was released a few weeks ago: https://secure.php.net/archive/2017.php#id2017-11-30-1 It adds support for LDAP EXOP in the ldap module, here are the new functions: https://secure.php.net/manual/en/function.ldap-exop.php https://secure.php.net/manual/en/function.ldap-parse-exop.php https://secure.php.net/manual/en/function.ldap-exop-passwd.php https://secure.php.net/manual/en/function.ldap-exop-whoami.php Note that support for LDAP controls is in the git branch for PHP 7.3. Do not hesitate to have a look and give feedback about this, it’s way easier to change things before first release as PHP have a strong backward compatibility policy. Côme

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical