openldap-technical

openldap-technical@openldap.org

9897 discussions

Re: Upgrade from 2.4.40 to 2.4.44
by rammohan ganapavarapu 14 Sep '17

14 Sep '17

Quanah, Thank you ,is there any thing else do i have to take care to upgrade from <=2.4.40 to 2.4.44? is there any upgrade doc that i can use? Ram On Thu, Sep 14, 2017 at 6:50 PM, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Thursday, September 14, 2017 7:24 PM -0700 rammohan ganapavarapu < > rammohanganap(a)gmail.com> wrote: > > I have ldap server with 2.4.40 and I have upgraded to 2.4.44 as part of >> yum upgrade, now I am not able to bring up ldap server , i am getting >> some ppolicy maxrecord failure attribute error, we are using ppolicy >> overlay, any advice how to fix this issue? >> > > > The schema for ppolicy was changed in 2.4.43. You have to add the the > following attribute to ppolicy.ldif: > > olcAttributeTypes: {16}( 1.3.6.1.4.1.42.2.27.8.1.30 NAME > 'pwdMaxRecordedFailure' EQUALITY integerMatch ORDERING integerOrderingMatch > SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) > > This should be done *prior* to upgrading. Unfortunately, it appears this > requirement was not well communicated. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > >

1 1

Re: Upgrade from 2.4.40 to 2.4.44
by rammohan ganapavarapu 14 Sep '17

14 Sep '17

If i accident allt upgrade rpm to 2.4.44 is there any way to fix this issue? On Sep 14, 2017 6:50 PM, "Quanah Gibson-Mount" <quanah(a)symas.com> wrote: --On Thursday, September 14, 2017 7:24 PM -0700 rammohan ganapavarapu < rammohanganap(a)gmail.com> wrote: I have ldap server with 2.4.40 and I have upgraded to 2.4.44 as part of > yum upgrade, now I am not able to bring up ldap server , i am getting > some ppolicy maxrecord failure attribute error, we are using ppolicy > overlay, any advice how to fix this issue? > The schema for ppolicy was changed in 2.4.43. You have to add the the following attribute to ppolicy.ldif: olcAttributeTypes: {16}( 1.3.6.1.4.1.42.2.27.8.1.30 NAME 'pwdMaxRecordedFailure' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) This should be done *prior* to upgrading. Unfortunately, it appears this requirement was not well communicated. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Upgrade from 2.4.40 to 2.4.44
by Quanah Gibson-Mount 14 Sep '17

14 Sep '17

--On Thursday, September 14, 2017 7:24 PM -0700 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > I have ldap server with 2.4.40 and I have upgraded to 2.4.44 as part of > yum upgrade, now I am not able to bring up ldap server , i am getting > some ppolicy maxrecord failure attribute error, we are using ppolicy > overlay, any advice how to fix this issue? The schema for ppolicy was changed in 2.4.43. You have to add the the following attribute to ppolicy.ldif: olcAttributeTypes: {16}( 1.3.6.1.4.1.42.2.27.8.1.30 NAME 'pwdMaxRecordedFailure' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) This should be done *prior* to upgrading. Unfortunately, it appears this requirement was not well communicated. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Olc deployment vs slapd.conf based deployment
by rammohan ganapavarapu 14 Sep '17

14 Sep '17

Thank you. On Sep 14, 2017 5:37 PM, "Quanah Gibson-Mount" <quanah(a)symas.com> wrote: > --On Thursday, September 14, 2017 6:30 PM -0500 Andy Dorman < > adorman(a)ironicdesign.com> wrote: > > I have our dev server using OLC and it takes me twice as long to modify >> it's config than the 15 other servers we have running openLDAP. >> > > It takes all of ldapadd/modify to modify cn=config. If you're having that > much difficulty, it sounds like you don't understand how to use cn=config. > > --Quanah > > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > > >

1 0

Re: Import LDIF from old OpenLDAP Server
by Quanah Gibson-Mount 14 Sep '17

14 Sep '17

--On Thursday, September 14, 2017 1:49 PM +0200 "Bänsch, Christian (TF)" <christian.baensch(a)fau.de> wrote: > dn: dc=ltm,dc=uni-erlangen,dc=de > dn: o=ltm,dc=uni-erlangen,dc=de These are clearly different root objects. You'll need to adjust the database root in your configuration to import your old database. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

RE: I can't seem to find the answer to these olcAccess questions
by Quanah Gibson-Mount 14 Sep '17

14 Sep '17

--On Tuesday, September 12, 2017 10:40 PM -0500 Nick Gray <nick(a)graysaustin.com> wrote: > I read the man page, but I guess I understood that the first rule only > matched everything as a far as "what" to access. I thought it went what, > who, permissions > > My intent was to enable both of these to work. > > Access to all > dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage > and access to all dn.base=" cn=Manager,dc=local,dc=bob,dc=com" to manage > as well Then it is a single ACL: olcAccess: {0} to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by dn="cn=Manager,dc=local,dc=bob,dc=com" manage --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Olc deployment vs slapd.conf based deployment
by rammohan ganapavarapu 14 Sep '17

14 Sep '17

Hi, I am trying to see what is the best and recommended way of deploying/starting ldap, OLC or conf file based? i was in the impression that conf file based is easy and more controllable approach than OLC? Thanks, Ram

1 0

Import LDIF from old OpenLDAP Server
by Bänsch, Christian (TF) 14 Sep '17

14 Sep '17

Dear list members, My apologies in advance, if it´s not the right place to ask for. I´m an absolute beginner in OpenLDAP and my first job is to relieve our old OpenLDAP Servers installed onto SLES 10.x. and migrate it to new hard- and software. Therefore I´ve installed and configured a test machine with Ubuntu 16.04 LTS to test the migration, import and later login and so on. OpenLDAP is version 2.4.42, installed from package manager. Later OpenLDAP should be running as a "provider/comsumer" for replica. The provider on a new hardware, the consumer within a VM. Both OS should be Ubuntu 16.04 LTS. After initial configuration slapcat show the following entries onto the test machine. ***** dn: dc=ltm,dc=uni-erlangen,dc=de objectClass: top objectClass: dcObject objectClass: organization o: ltm dc: ltm structuralObjectClass: organization entryUUID: bfca1276-1852-1037-80bd-373544139e33 creatorsName: cn=admin,dc=ltm,dc=uni-erlangen,dc=de createTimestamp: 20170818111847Z entryCSN: 20170818111847.816167Z#000000#000#000000 modifiersName: cn=admin,dc=ltm,dc=uni-erlangen,dc=de modifyTimestamp: 20170818111847Z dn: cn=admin,dc=ltm,dc=uni-erlangen,dc=de objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: e1NTSEF9YUJ2VGF1YVgxODJpNE1zaTVwNkRnVWR2NDN1TnFzZUI= structuralObjectClass: organizationalRole entryUUID: bfd1af40-1852-1037-80be-373544139e33 creatorsName: cn=admin,dc=ltm,dc=uni-erlangen,dc=de createTimestamp: 20170818111847Z entryCSN: 20170818111847.866104Z#000000#000#000000 modifiersName: cn=admin,dc=ltm,dc=uni-erlangen,dc=de modifyTimestamp: 20170818111847Z ***** First I´ve tried with a copy from the original LDAP-Server DB.ldif file from the old server to import, but it fails. Here´s an "extract" from a few lines of DB.LDIF" ***** dn: o=ltm,dc=uni-erlangen,dc=de o: ltm objectClass: organization structuralObjectClass: organization entryUUID: c517ac96-315a-102c-8517-630622d96f14 creatorsName: cn=Administrator,o=ltm,dc=uni-erlangen,dc=de modifiersName: cn=Administrator,o=ltm,dc=uni-erlangen,dc=de createTimestamp: 20071127173437Z modifyTimestamp: 20071127173437Z entryCSN: 20071127173437Z#000000#00#000000 ... ***** After that I´ve created with ldapsearch created an save.ldif file to avoid those lines like creators and modifiers from the running LDAP-Server and tried to import into the new one but it also fails. The error was Server is unwilling to perform (53) additional info: no global superior knowledge Now I´m a little bit confused about import. So I tried to modify the new server entry like the old - my thougt was a conflict in the dn: o=ltm,dc=uni-erlangen,dc=de - but I´ve got no chance. Modifying the new entry onto the test machine says: " Strong(er) authentication required" Could you please give me any hint? Or is there another way? Any help would be greatly appreciated! If you need additional information, please let me know. Thanks in advance! -- Yours sincerely, Christian Baensch

1 0

Re: Where is the '-C' option to 'ldapsearch' documented?
by Howard Chu 13 Sep '17

13 Sep '17

Brian Reichert wrote: > On Tue, Sep 12, 2017 at 01:00:25PM -0700, Ryan Tandy wrote: >> On Tue, Sep 12, 2017 at 03:56:07PM -0400, Brian Reichert wrote: >>> Is this a supported option? Is it documented somewhere officially? >>> I couldn't find it after a quick search... >> >> According to http://www.openldap.org/its/?findid=7177 it is "deprecated >> and intentionally undocumented". > > Helpful pointer, thanks! > > If it's deprecated, what's the approved method of coercing ldapsearch > to pursue referrals? > ldapsearch shouldn't pursue referrals. The directory server you're using should chain requests for you instead of ever returning referrals. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 3

Re: Where is the '-C' option to 'ldapsearch' documented?
by Howard Chu 13 Sep '17

13 Sep '17

Brian Reichert wrote: > On Tue, Sep 12, 2017 at 10:07:29PM +0100, Howard Chu wrote: >> Brian Reichert wrote: >>> On Tue, Sep 12, 2017 at 01:00:25PM -0700, Ryan Tandy wrote: >>>> On Tue, Sep 12, 2017 at 03:56:07PM -0400, Brian Reichert wrote: >>>>> Is this a supported option? Is it documented somewhere officially? >>>>> I couldn't find it after a quick search... >>>> >>>> According to http://www.openldap.org/its/?findid=7177 it is "deprecated >>>> and intentionally undocumented". >>> >>> Helpful pointer, thanks! >>> >>> If it's deprecated, what's the approved method of coercing ldapsearch >>> to pursue referrals? >>> >> ldapsearch shouldn't pursue referrals. The directory server you're using >> should chain requests for you instead of ever returning referrals. > > Regrettably, the directory server, in this case, is Active Directory. > > https://technet.microsoft.com/en-us/library/cc978014.aspx > > Active Directory returns referrals in accordance with RFC 2251. > > https://social.technet.microsoft.com/Forums/ie/en-US/41d26e7a-a65c-47fe-b81… > > I don't see Microsoft changing their tune anytime soon. :/ > > I have to admit, this is the first I've heard of chaining a request. > > This might a way out for me: > > http://blog.heeresonline.com/2014/04/activedirectory-ldap-referrals-chasing/ > > In any event, it's clear that directory servers _can_ return > referrals, and as such, it surprises me that there isn't a supported > way for OpenLDAP's tool to honor such a configuration. > > I presume this has been discussed to death on this list, but I > couldn't find any historical threads on the topic. Can you provide > some references? The option was removed from the documentation back in 2002. Most likely any discussion would have been on the openldap-software mailing list, which was used before openldap-technical was created. I suggest you look at http://lmgtfy.com/?q=site:openldap.org+referral+ldapsearch -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical