openldap-technical

openldap-technical@openldap.org

22 participants
9789 discussions

RE: Issue importing CGP schema into LDAP (centos 7)
by Quanah Gibson-Mount 03 May '17

03 May '17

--On Wednesday, May 03, 2017 9:28 AM -0400 John Cooter <jcooter(a)atlantech.net> wrote: > So, just to confirm what you're saying, that EVEN THOUGH the existing > schema has all the prerequisite objectClass and other object types, and > even though I'm attempting to use slaptest to convert a single extended > .schema, a holdover from an earlier version of openldap, to an .ldif in > the configuration cn, that my test.conf, must have lines that include all > the other base schema files as well? You should absolutely not be including elements from other schema into the file simply for the purpose of conversion, as you will end up with a file you won't be able to import to cn=config if it has those other schema included. And, if it had all the elements as you claim, then you certainly wouldn't be getting an error about the "organization" objectClass being missing, given that that comes from the "core" schema file. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 3

RE: Issue importing CGP schema into LDAP (centos 7)
by Quanah Gibson-Mount 03 May '17

03 May '17

--On Tuesday, May 02, 2017 5:02 PM -0400 John Cooter <jcooter(a)atlantech.net> wrote: > The existing configuration, was created as follows: > Install ldap and related services > ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif > ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif > ldapadd -Y EXTERNAL -H ldapi:/// -f > /etc/openldap/schema/inetorgperson.ldif create test.conf which only > contains a single line: include /etc/openldap/schema/cgp.schema run > slaptest statement, as listed below. Get error. > This slaptest statement should normally allow me to create the ldif to > add to the schema, but it keeps failing. And I'm trying to figure out why > and what I'm doing wrong. Your test LDIF file for converting schema must include all other schema that it is dependent upon for it to be able to convert properly. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 2

Issue importing CGP schema into LDAP (centos 7)
by John Cooter 02 May '17

02 May '17

I have been tasked with virtualizing our existing, aging, LDAP and CommuniGate Pro instances. Doing so will require moving from RHEL 5.X to CentOS 7.X, which means that the existing LDAP implementation has changed. Upon attempting to perform a "slaptest -f test.conf -F testing" where test.conf contains only an include statement that points to /etc/openldap/schema/cgp.schema, and testing is an empty directory, I receive the following error message: 59033edc /etc/openldap/schema/cgp.schema: line 640 objectClass: ObjectClass not found: "organization" slaptest: bad configuration directory! I am able to verify that the various base includes in my LDAP server do include an objectClass "organization" and can verify same in phpLDAPadmin, and in other methods. I am new to the concepts presented here, and since we are using LDAP in what appears to me to be a non-standard use case, I am at a loss. I present the relevant "line 640" below, from the schema I am attempting to import: objectClass ( 2.5.1000.0 NAME 'CommuniGateDomain' SUP 'organization' STRUCTURAL MAY ( cn $ dc ) ) Can someone perhaps tell me where I am going wrong, or how to more effectively troubleshoot this import?

2 4

password change interception overlay
by Michael Ströder 02 May '17

02 May '17

HI! Does anybody know a publicly available overlay which intercepts userPassword changes and grabs the new password for password syncing? Ciao, Michael.

2 2

Using CRLs
by Frank Crow 02 May '17

02 May '17

Is it possible to configure OpenLDAP to trust all certs for validity but then also check a CRL to see if the certificate may have been revoked (to reject it)? Sounds crazy to me and I highly doubt it but I'm asking because somebody handing us requirements is convinced that it is possible to not have connectivity to a CA, and validate a user cert for login using only a CRL. Does that make any sense at all? Thanks, -- Frank

2 1

Re: Multi Master replication with many 'nonpresent_callback' lines
by Quanah Gibson-Mount 02 May '17

02 May '17

--On Sunday, April 23, 2017 12:38 AM +0000 Jesper Grøndahl <grondahl(a)ruc.dk> wrote: > Our log level is stats and sync. > > The logs look like this, for the user being modified > ----- > nonpresent_callback: rid=005 present UUID > 528929d6-acaa-1036-922a-a3f5c9285d9d, dn uid=xxx,ou=users,dc=ruc,dc=dk > Entry uid=xxx,ou=users,dc=ruc,dc=dk CSN > 20170406140323.504919Z#000000#002#000000 greater than snapshot > 20170403102309.253881Z#000000#002#000000 It would appear you have serious issues with your installation, since the CSNs are off by 3 days. I would note that 2.4.40 is not stable for MMR as well. I would ensure you aren't suffering from clock skew across your servers, and upgrade to the current OpenLDAP release as well. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

detect LDAPI support
by Michael Ströder 27 Apr '17

27 Apr '17

HI! Is there an reliable way to detect whether LDAPI support is enabled in the OpenLDAP build on a particular platform? I vaguely remember the developer discussions about disabling LDAPI on platforms where the peer credentials are not secure. Background: I'd like to detect with python-ldap whether to enable LDAPI in automatic testing or not. Ciao, Michael.

2 2

test program for ldap_int_sasl_init issue
by Ryan Tandy 26 Apr '17

26 Apr '17

I'm looking into a Debian bug report: https://bugs.debian.org/860947 ldap_int_sasl_init says: /* XXX not threadsafe */ static int sasl_initialized = 0; I'm not yet sure whether it's the cause of that report, but it does seem to be problematic. I'm seeing spurious "no such mechanism" results and/or crashes in mutiple environments performing SASL binds in parallel: - slapd with multiple syncrepl clients all using SASL binds, - the ldclt tool from the 389-ds project, and - the test program I'm about to describe below. I wrote a test program for this issue, and I'd like to ask the list to check the code before I submit an ITS, in case I've made a mistake that renders my test invalid. gcc -g sasltest.c -pthread -llber -lldap -lsasl2 -DSASL As I understand it, -lldap_r should not be needed here since each thread creates its own LDAP instance. (It doesn't seem to change the results, anyway.) Built without -DSASL, it uses simple binds, and appears to work fine, but again, I'm not confident my code is correct. Thanks! Ryan

1 0

Re: chain overlay does an anonymous bind and ignores the chain binddn (v2.4.44)
by Howard Chu 26 Apr '17

26 Apr '17

Matthew Kemp wrote: > > On Thu, Apr 20, 2017 at 6:36 AM, mailing lists <listas.correo(a)yahoo.es > <mailto:listas.correo@yahoo.es>> wrote: > > Hello, > > I am testing the chain overlay from a read-only slave (consumer) slapd > server to a read-write master (provider), but what I am seeing is an > anonymous bind from the consumer to the provider instead of the > authorization identity configurated in the chain directive. > > > We're also seeing the same behavior and reported a similar issue last month to > this list: > http://www.openldap.org/lists/openldap-technical/201703/msg00047.html > > I'm hopeful we can track down this issue as it's causing us some issues that > we'll need to resolve eventually. Only ProxyAuth will work, now. As documented, the chain overlay only intercepts responses to operations, and only acts when it sees a referral in the response. In order for rebind-as-user to work, the overlay would need to intercept Bind requests and cache the credentials, but it never intercepts Bind requests, therefore it has nothing to rebind with. It *could* intercept referrals from Bind responses, and grab the user's credentials at that point. But back in 2004 we turned those off, and slapd now will never return a referral to a Bind request. (commit 100facedf3c9ec241121a5e3ad7aa059a7c57bc2 in git.) Probably we should remove references to rebind-as-user from the slapo-chain(5) manpage now, since that commit basically killed this feature. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Re: chain overlay does an anonymous bind and ignores the chain binddn (v2.4.44)
by Matthew Kemp 26 Apr '17

26 Apr '17

On Wed, Apr 26, 2017 at 4:12 PM, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > Hi Matthew, > > Can you look at follow up#4 to ITS#8008 and see if that helps your > situation? > > --Quanah > Hey Quanah! Thanks for reaching out! Sadly in my case the update is not specifically helpful in my case. I found the override flag already, but I do not want to use a ProxyAuth and instead want to bind as the originating user who bound to the consumer. Override allows a ProxyAuth to be used rather than an anonymous bind, which is better, but not the intended behavior I want that the documentation seems to imply is possible. -- Matt Kemp Production Engineer Braintree

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical