openldap-technical

openldap-technical@openldap.org

9897 discussions

I can't seem to find the answer to these olcAccess questions
by Nick Gray 12 Sep '17

12 Sep '17

I have a very simple config that I can show with ldapsearch -LLLQY EXTERNAL -H ldapi:/// -b cn=config olcDatabase=\* dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig olcDatabase: {-1}frontend olcAccess: {0} to * by dn="cn=Manager,dc=local,dc=bob,dc=com" manage dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0} to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external l,cn=auth" manage olcAccess: {1} to * by dn="cn=Manager,dc=local,dc=bob,dc=com" manage dn: olcDatabase={1}monitor,cn=config objectClass: olcDatabaseConfig olcDatabase: {1}monitor olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth" read by dn.base="cn=Manager,dc=my-domain,dc=com" read by * none dn: olcDatabase={2}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {2}mdb olcDbIndex: objectClass eq,pres olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub olcDbDirectory: /data/openldap olcRootDN: cn=Manager,dc=local,dc=bob,dc=com olcSuffix: dc=local,dc=bob,dc=com olcRootPW: {SSHA}3E+8/IcRHHTNez5QXlyRMP6mCZODN3LE olcAccess: {0} to * by dn="cn=Manager,dc=local,dc=bob,dc=com" manage With this config,.shouldn't this work as well ldapsearch -x -W -D cn=Manager,dc=local,dc=bob,dc=com -b cn=config olcDatabase=\* My other question is where is there a reference to exactly what "gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth" means. I can't seem to find one. Thanks Nick

2 2

Where is the '-C' option to 'ldapsearch' documented?
by Brian Reichert 12 Sep '17

12 Sep '17

I was debugging some random issue involving pursuing referrals, and found a note on this page: http://etutorials.org/Server+Administration/ldap+system+administration/Part… And it makes this assertion: By default, the ldapsearch tool shipped with OpenLDAP 2 prints information about referral objects but does not automatically follow them. ... To follow the search referral, give the -C (chase referrals) option when you invoke ldapsearch: And, by golly, it worked! I'm using the openldap-ltb-2.4.39-2.el6.x86_64 RPM package, and that package's manpage and 'ldapsearch --help' show nothing about this option. Is this a supported option? Is it documented somewhere officially? I couldn't find it after a quick search... -- Brian Reichert <reichert(a)numachi.com> BSD admin/developer at large

2 2

Re: OpenLDAP taker a long time (90s+) to shutdown
by Quanah Gibson-Mount 12 Sep '17

12 Sep '17

--On Tuesday, September 12, 2017 8:52 PM +0900 Alexandre Rosenberg <arekkusu(a)r42.ch> wrote: > dbnosync Why did you set this? > I was wondering what is the expected time for OpenLDAP to shutdown. > Also I am unsure if the checkpoiont setting could be related. It generally depends on how much information there is to flush out to disk, and that can depend on the speed of the disk subsystem. I would note, for example, that in some AWS environments, this can take an exceptionally long time. YMMV. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: I can't seem to find the answer to these olcAccess questions
by Quanah Gibson-Mount 12 Sep '17

12 Sep '17

--On Tuesday, September 12, 2017 1:38 PM -0700 Ryan Tandy <ryan(a)nardis.ca> wrote: > On Mon, Sep 11, 2017 at 04:18:20PM -0500, Nick Gray wrote: >> With this config,.shouldn't this work as well >> >> ldapsearch -x -W -D cn=Manager,dc=local,dc=bob,dc=com -b cn=config >> olcDatabase=\* > > The rules on your config database are: > > olcAccess: {0} to * by > dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage > olcAccess: {1} to * by dn="cn=Manager,dc=local,dc=bob,dc=com" manage > > The first matches everything (*), so the second is never consulted. Which is specifically noted in the slapd.access(5) man page: The optional field <control> controls the flow of access rule application. It can have the forms stop continue break where stop, the default, means access checking stops in case of match. So as noted in the man page, ACL processing stops at the first matching access rule. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Invalid credentials problem
by Quanah Gibson-Mount 12 Sep '17

12 Sep '17

--On Tuesday, September 12, 2017 2:34 PM +0000 JC <lovecraftesque(a)yahoo.com> wrote: > > > > Thanks. I now know. Perhaps OpenLDAP might return a somewhat less > misleading error diagnostic in situations like this? It is not misleading, it is as per RFC. The issue is more, being new to LDAP, you're not aware of what the message means. ;) Also, please keep replies on the -technical list. More specifically, invalid credentials simply means some part of the credentials supplied is incorrect. In your case it was the DN. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

OpenLDAP taker a long time (90s+) to shutdown
by Alexandre Rosenberg 12 Sep '17

12 Sep '17

Hello, I run into a issue where OpenLDAP would not shutdown within 90s. Sometimes shutdown is fast and sometimes not. This concern production server getting a fair amount of traffic. The reason I am mentioning 90s is because this is the default timeout for sytemd service. After that time it sends SIGKILL to the process. I am running latest OpenLDAP (2.45) with MDB database (~1GB). The server is a consumer of another OpenLDAP Server. Maybe more importantly following directive are present under the MDB database configuration. dbnosync checkpoint 500 5 I was wondering what is the expected time for OpenLDAP to shutdown. Also I am unsure if the checkpoiont setting could be related. Best, Alex

1 0

Re: Controls answers, OID unicity
by Howard Chu 12 Sep '17

12 Sep '17

Côme Chilliet wrote: > Hello, > > As some may know I’m working toward supporting controls in php-ldap. > > I’m facing two questions regarding controls to help me build the API: > - Is it possible to have several controls with the same OID in a request or response? (if not it would allow me to parse the answer to a control hash with oid as keys) > -> I tried to put twice the same control with «LDAP_CONTROL_PRE_READ» and got the error "preread control: specified multiple times", but I do not know if this is specific to preread or if it’s a rule. Not possible, no. > - Is the critical field of controls used in responses? It seems openldap server let it to false always (or I’m failing to parse it). RFC4511 section 4.1.11 is quite explicit here - the critical field in responses is always false. > > I could not find information about these subjects in RFC 2251, if there is an other RFC on this subject bringing more information do not hesitate to point me to it :-) > > Côme > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Controls answers, OID unicity
by Côme Chilliet 12 Sep '17

12 Sep '17

Hello, As some may know I’m working toward supporting controls in php-ldap. I’m facing two questions regarding controls to help me build the API: - Is it possible to have several controls with the same OID in a request or response? (if not it would allow me to parse the answer to a control hash with oid as keys) -> I tried to put twice the same control with «LDAP_CONTROL_PRE_READ» and got the error "preread control: specified multiple times", but I do not know if this is specific to preread or if it’s a rule. - Is the critical field of controls used in responses? It seems openldap server let it to false always (or I’m failing to parse it). I could not find information about these subjects in RFC 2251, if there is an other RFC on this subject bringing more information do not hesitate to point me to it :-) Côme

1 0

Re: pwdAccountLockedTime not in ppolicy.ldif
by Quanah Gibson-Mount 11 Sep '17

11 Sep '17

--On Monday, September 11, 2017 3:01 PM +0200 Jacques Loonen <j.loonen(a)ru.nl> wrote: Hi Jacques, > We use cn = config, so we load ppolicy.ldif. pwdaccountlockedtime is not > included in this file. It is not included in ppolicy.schema or ppolicy.ldif. It is a hard-coded part of the ppolicy overlay. My guess is that while you included the ppolicy overlay in your slapd.conf configuration, you failed to properly load it when using cn=config. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Invalid credentials problem
by Quanah Gibson-Mount 11 Sep '17

11 Sep '17

--On Sunday, September 10, 2017 12:19 AM +0000 JC <lovecraftesque(a)yahoo.com> wrote: > rootdn "uid=root,ou=People,dc=owns4,dc=com" ># ldapwhoami -x -H ldap://myipaddress -D "dc=owns4,dc=com" -w xyzabc > ldap_bind: Invalid credentials (49) What makes you believe that "dc=owns4,dc=com" is a valid identity to bind as? It certainly doesn't match the rootdn you configured. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical