openldap-technical

openldap-technical@openldap.org

22 participants
9789 discussions

Re: [Q] can I replicate several branches to the same slave from one master?
by Quanah Gibson-Mount 27 Jul '17

27 Jul '17

--On Friday, June 30, 2017 8:32 AM +0300 Zeus Panchenko <zeus(a)ibs.dn.ua> wrote: >> And what does the master say? >> > > same thing: > > slapd[38004]: conn=30116 op=3 SEARCH RESULT tag=101 err=53 nentries=0 > text=consumer state is newer than provider! It sounds like your replica was not configured correctly initially and self-generated its own CSN that is newer than the one on the provider. It would be interesting to make a modification on the provider so that its CSN is updated (and thus has one newer than on the consumer). --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

[Q] "selective" ACL
by Zeus Panchenko 26 Jul '17

26 Jul '17

hi, I'm trying to configure a not complex (as I believe) ACL ... but have some difficulties I have two posixGroup groups cn=admins,ou=group,dc=foo cn=coadmins,ou=group,dc=foo my users resides in ou=People,dc=foo so, in subtree ou=People,dc=foo I need to allow anything to admins (and it is not difficult of course) for example this works for me: access to dn.subtree="ou=People,dc=foo" by set="[cn=admin,ou=group,dc=foo]/memberUid & user/uid" manage by self write by users read by * break but in addition I need to allow my coadmins to do the same things except manipulations upon the objects which belong to admins ( ...anyobject,uid=adminuser,ou=People,dc=foo ) so, the question is: how? (if it is possible at all) :( please, advise -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET)

2 2

Sometimes openldap messages are logged in incorrect order
by Amit 26 Jul '17

26 Jul '17

Hello, I find sometimes order of event in openldap logs as: BIND RESULT ACCEPT SRCH base SRCH attr= SEARCH RESULT closed Configured rsyslog as: $template myTemplate,"%timegenerated:::date-rfc3339% %timereported:::date-rfc3339% %msg%\n" local4.* /var/log/rsyslog.log;myTemplate But I believe correct order should be: Accept Bind result srch base unbind closed What cant be the reason, is it related to openldap logging mechanism or Logger rsyslog. -- Thanks Amit

3 4

Re: Antw: Re: Limiting Search Results By Group Membership
by Howard Chu 25 Jul '17

25 Jul '17

Ulrich Windl wrote: >>>> Howard Chu <hyc(a)symas.com> schrieb am 25.07.2017 um 14:27 in Nachricht > <48d74363-2f0a-739f-d719-515e1fe14997(a)symas.com>: >> Ulrich Windl wrote: >>> BTW: Is there an LDAP query to get the schema name for an object class? >>> I can list objectclasses and schematas, but I miss the link between those. >> >> You can search under cn=schema,cn=config using filter >> (olcObjectClasses=*<objectclass name>*) > > Hi! > > Thanks, but I don't quite get it: If I'm trying for "ipService" (which is known), I get an empty result: > > # ldapsearch -Y EXTERNAL -H ldapi:/// -b 'cn=schema,cn=config' -s one '(olcObjectClasses=ipService)' '* +' > SASL/EXTERNAL authentication started > SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth > SASL SSF: 0 > # extended LDIF > # > # LDAPv3 > # base <cn=schema,cn=config> with scope oneLevel > # filter: (olcObjectClasses=ipService) > # requesting: * + > # > > # search result > search: 2 > result: 0 Success > > Can you give a concrete example, maybe? Pay attention to details. The filter I specified was ( * <objectclass name> * ) - a substring filter. The filter you used was an exact match filter, which obviously doesn't match anything. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Re: Antw: Re: Limiting Search Results By Group Membership
by Howard Chu 25 Jul '17

25 Jul '17

Ulrich Windl wrote: > BTW: Is there an LDAP query to get the schema name for an object class? > I can list objectclasses and schematas, but I miss the link between those. You can search under cn=schema,cn=config using filter (olcObjectClasses=*<objectclass name>*) -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Re: Sometimes openldap messages are logged in incorrect order
by Howard Chu 25 Jul '17

25 Jul '17

Amit wrote: > Hello, > > I find sometimes order of event in openldap logs as: > BIND > RESULT > ACCEPT > SRCH base > SRCH attr= > SEARCH RESULT > closed > > Configured rsyslog as: > $template myTemplate,"%timegenerated:::date-rfc3339% > %timereported:::date-rfc3339% %msg%\n" > local4.* /var/log/rsyslog.log;myTemplate > > But I believe correct order should be: > Accept > Bind > result > srch base > unbind > closed > > What cant be the reason, is it related to openldap logging mechanism or Logger > rsyslog. Sounds like an rsyslog issue. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: Limiting Search Results By Group Membership
by Douglas Duckworth 24 Jul '17

24 Jul '17

Thank you both for your guidance. I will try this now. Doug Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-6305 F: 212-746-8690 On Mon, Jul 24, 2017 at 10:31 AM, Michael Ströder <michael(a)stroeder.com> wrote: > Douglas Duckworth wrote: > > If OpenLDAP can run with this schema then why wasn't support for this > feature created? > > There is a contrib/ overlay but I'd not use it. > > > What's the recommend schema? > > Simply start with groupOfNames. > > Ciao, Michael. > > > On Jul 21, 2017 1:44 PM, "Quanah Gibson-Mount" <quanah(a)symas.com > > <mailto:quanah@symas.com>> wrote: > > > > --On Friday, July 21, 2017 2:24 PM -0400 Douglas Duckworth > > <dod2014(a)med.cornell.edu <mailto:dod2014@med.cornell.edu>> wrote: > > > > > > > Am I rfc2307 or rfc2307bis? According to sssd-ldap man page: > > > > Per nis.schema: > > > > # Definitions from RFC2307 (Experimental) > > # An Approach for Using LDAP as a Network Information Service > > > > > > so it is RFC2307 as opposed to RFC2307bis. Neither schema has ever > made it > > past experimental. > > > > --Quanah > >

1 1

Re: Limiting Search Results By Group Membership
by Douglas Duckworth 24 Jul '17

24 Jul '17

If OpenLDAP can run with this schema then why wasn't support for this feature created? What's the recommend schema? On Jul 21, 2017 1:44 PM, "Quanah Gibson-Mount" <quanah(a)symas.com> wrote: > --On Friday, July 21, 2017 2:24 PM -0400 Douglas Duckworth > <dod2014(a)med.cornell.edu> wrote: > > > > Am I rfc2307 or rfc2307bis? According to sssd-ldap man page: > > Per nis.schema: > > # Definitions from RFC2307 (Experimental) > # An Approach for Using LDAP as a Network Information Service > > > so it is RFC2307 as opposed to RFC2307bis. Neither schema has ever made it > past experimental. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <https://urldefense.proofpoint.com/v2/url?u=http- > 3A__www.symas.com&d=DwIFaQ&c=lb62iw4YL4RFalcE2hQUQealT9- > RXrryqt9KZX2qu2s&r=2Fzhh_78OGspKQpl_e-CbhH6xUjnRkaqPFUS2wTJ2cw&m= > QjNwZbNvK3tkFCecwXFhz1ywKJbFr_zOd4L5bNHwKpc&s= > M9eRNUisYljobqAKHQaLfans5QZ9DGU5Srnk8kR6mso&e= > > >

2 1

Re: Limiting Search Results By Group Membership
by Quanah Gibson-Mount 24 Jul '17

24 Jul '17

--On Monday, July 24, 2017 10:23 AM -0400 Douglas Duckworth <dod2014(a)med.cornell.edu> wrote: > > If OpenLDAP can run with this schema then why wasn't support for this > feature created? ldap groups have a specific meaning and it has nothing to do with either of those schemas. The documentation is clear on what's required to use the limits feature with groups, which is a DN type attribute such as "member". I'm not sure what "feature" you feel support wasn't created for. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

ppolicy and controls
by Côme Chilliet 24 Jul '17

24 Jul '17

Hello, I’m trying to understand how to use controls and EXOP with ppolicy overlay. I can get controls in the result from bind to get info like expired password. I can use an exop to change the password in which case an invalid password will get refused, but I’m not sure how to get the ppolicy reason for the refusal. There is ldap_parse_passwordpolicy_control but I don’t know how to get a control object to give to it. ldap_passwd_s does not return a result object for which to search controls in. It does take serverctrls and clientctrls as parameters but looking at the code it seems serversctrls is an input parameter, I’m not sure what it can be useful for. And clientctrls seems ignored, is it unused or deprecated? Côme

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical