openldap-technical

openldap-technical@openldap.org

5 participants
9899 discussions

Re: LDAP Issue: Logging region out of memory; you may need to increase its size
by Quanah Gibson-Mount 10 Jun '17

10 Jun '17

--On Saturday, June 10, 2017 12:00 PM +0200 Dieter Klünter <dieter(a)dkluenter.de> wrote: > Am Fri, 9 Jun 2017 11:27:32 +0000 > schrieb Gurjot Kaur <gurjot.kaur(a)aricent.com>: > >> Hello, >> >> On an already running setup of OpenLDAP 2.4 on Linux (Linux GURKES015 >> 2.6.18-128.el5 #1 SMP Wed Dec 17 11:41:38 EST 2008 x86_64 x86_64 >> x86_64 GNU/Linux) platform, one day I start getting following error >> when I execute the slapcat command: >> >> bdb_db_open: warning - no DB_CONFIG file found in I would also note that for current releases of OpenLDAP, the bdb backend is deprecated, and it's proably worthwhile to take the time to migrate to back-mdb, which doesn't have these issues. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

rwm - send in peername?
by Etan Weintraub 08 Jun '17

08 Jun '17

Is there a way to reference the remote IP (I'm assuming that's in peername based on ACL's) in configuration directives? I.e. I'd like to do the following: overlay rwm rwm-rewriteEngine on rwm-rewriteParam remoteip {peername} rwm-rewriteContext bindDN rwm-rewriteRule "^(.+,)?dc=mfa$" "$1dc=${$remoteip},dc=mfa" ":@" And have the DN for the bind look like uid=user,dc=127.0.0.1,dc=mfa instead of uid=user,dc=mfa Is that possible? -Etan E. Weintraub Information Security Architect IT@Johns Hopkins Johns Hopkins at Mt. Washington <x-apple-data-detectors://4/> 5801 Smith Ave. Davis Building <x-apple-data-detectors://4/> Suite 3110B <x-apple-data-detectors://5/0> Baltimore, MD 21209 Phone: <tel:667-208-6309> 667-208-6309 E-mail: <mailto:eweintra@jhmi.edu> eweintra(a)jhmi.edu

1 0

RE: Limiting which attributes get replicated
by Quanah Gibson-Mount 08 Jun '17

08 Jun '17

--On Thursday, June 08, 2017 2:38 PM +0000 Etan Weintraub <eweintra(a)jhmi.edu> wrote: > Actually, I've found another possible way. If I use the rwm overlay, I can > modify the DN that is sent in. I just need a way to get the IP to put in > the rewriteRule and I should be good. Any ideas on that? I'm not clear on what slapo-rwm has to do with limiting what attributes get replicated. This isn't about rewrite. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Limiting which attributes get replicated
by Quanah Gibson-Mount 08 Jun '17

08 Jun '17

--On Thursday, June 08, 2017 12:28 PM +0100 Philip Colmer <philip.colmer(a)linaro.org> wrote: > What happens if one of the consuming LDAP servers is then itself > queried for an attribute that hasn't been synced? So, for example, if > a system in a data centre connects to a local consuming LDAP server > and asks for a jpegPhoto, that won't be on the local server, so what > happens then? Might be easiest to use an ACL to drop the attributes you don't want it to replicate for the replication DN for those consumers. As for what happens when a client requests jpegPhoto and it doesn't exist, the same thing that happens for any client that requests an attribute that doesn't exist -- It won't get a result that includes that attribute. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Limiting which attributes get replicated
by Philip Colmer 08 Jun '17

08 Jun '17

Hi We've got a core set of OpenLDAP servers that are in a multi-master configuration. We are looking at building out that set of servers so that our data centres can have local copies of the data. However, those copies don't need to be of everything, so I want to limit which attributes get replicated. I wanted to check that I've understood the configuration correctly ... According to http://www.openldap.org/doc/admin22/syncrepl.html, it looks like I can specify on the consuming LDAP server which attributes are synced, and I can also ensure that the binddn account only has access to those attributes on the providing LDAP server. The example given in the documentation has: filter="(objectClass=organizationalPerson)" What do I do if I want to synchronise all objectClasses but only restrict the attributes on the organizationalPerson class? So, for example, I want everything on groups but I don't want jpegPhoto on people. What happens if one of the consuming LDAP servers is then itself queried for an attribute that hasn't been synced? So, for example, if a system in a data centre connects to a local consuming LDAP server and asks for a jpegPhoto, that won't be on the local server, so what happens then? Thank you. Philip

1 0

Security Enclaves
by Derrick McKee 08 Jun '17

08 Jun '17

Greetings, I am a computer security researcher working on adding functionality to the hardware security enclaves recently released on CPUs (e.g. Intel SGX or ARM TrustZone). I think that OpenLDAP would suit my purposes well, and I was thinking of attempting to secure SASL and TLS/SSL functionality. My plan is to get OpenSSL to use the secure enclave, and adopt OpenLDAP to use the enclave as well for SASL and TLS. I just need a little help on where to start looking. I have seen sasl.c and saslauthz.c in servers/slapd, as well as tls2.c in libraries/libldap and libraries/libldap_r. Anywhere else I should be looking? Is the only difference between libraries/libldap and libraries/libldrap_r just the use of threads? Finally, any other ideas about what else I can protect? For those unfamiliar, security enclaves allow for virtual address ranges to be encrypted/decrypted on the processor itself. So even an adversary with root privileges would not be able to read data/code/whatever within the secure address range. Thanks in advance for any help. - Derrick McKee -- Derrick McKee Ph.D. Student at Purdue University

1 0

Attempting to set Access Control for auth to Perl Backend
by Etan Weintraub 06 Jun '17

06 Jun '17

Hi all- I'm configuring an OpenLDAP server with the Perl Backend. I've been able to set permissions for search on one of my backends to lock it down based on IP as follows: access to dn.sub="dc=alias" by peername.ip=127.0.0.1 read by peername.ip=10.181.24.193 read by peername.ip=10.181.35.243 read by * none That makes it that only those IP's listed can search and get results from that branch. I now need to do the same type of thing for another branch, but for authentication instead (i.e. only allow auth to occur if coming from an approved IP). I've tried the following: access to dn.sub="dc=mfa" by peername.ip=127.0.0.1 auth by peername.ip=10.181.24.193 auth by * none But no luck. Any ideas/help? If I can't do this with an ACL, if I can get the IP address of the request passed in to the bind function in the Perl backend, I can handle the controls there. -Etan E. Weintraub Information Security Architect IT@Johns Hopkins Johns Hopkins at Mt. Washington <x-apple-data-detectors://4/> 5801 Smith Ave. Davis Building <x-apple-data-detectors://4/> Suite 3110B <x-apple-data-detectors://5/0> Baltimore, MD 21209 Phone: <tel:667-208-6309> 667-208-6309 E-mail: <mailto:eweintra@jhmi.edu> eweintra(a)jhmi.edu

1 0

Re: How wold you go about writing a new OpenLDAP backend?
by Howard Chu 05 Jun '17

05 Jun '17

Prentice Bisbal wrote: > On 05/31/2017 12:37 AM, John Lewis wrote: > >> What if I wanted to write a OpenLDAP backend for a systemd journal file >> or Elasticsearch so I can present my logs as an LDAP subtree so I can >> use my LDAP tools to filter my logs? Should I use back-shell for >> prototyping? If so, what is the usual work flow? > This sounds like the wrong tool for this job. Really? Can you give a point by point comparison against what you think is the "right" tool for the job? -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 4

Directory Sever Gateway for OpenLDAP
by John Lewis 05 Jun '17

05 Jun '17

Is there something like 389 Directory Server Gateway (389-dsgw) for OpenLDAP? Is there some way to borrow 389-dsgw itself and run it standalone and aim it at OpenLDAP? I am looking for some kind of service I can run to get a phonebook, orgchart, advanced search interface, and DSML gateway. Having a frontend like this would make it easier for people to buy into the idea of a directory server for things they interact with directly before introducing thick clients.

2 1

Re: How wold you go about writing a new OpenLDAP backend?
by Quanah Gibson-Mount 02 Jun '17

02 Jun '17

--On Friday, June 02, 2017 3:02 PM -0400 Prentice Bisbal <pbisbal(a)pppl.gov> wrote: > Well, that certainly sounds like the missing link, doesn't it? ;) > > What is different about your native backends that makes them so much > faster? Domain-specific design? I haven't been keeping up with OpenLDAP > over the past few years. The versions I've used in the bast used BDB for > the backend. I've been charged with upgrading an old LDAP server, and as > I was looking through the documentation for the latest version, I saw > that you have some new native backend(s), but I didn't have time to read > up on them. You might find some of this useful: <https://en.wikipedia.org/wiki/Lightning_Memory-Mapped_Database> <https://mishikal.wordpress.com/2013/05/16/openldap-a-comparison-of-back-mdb…> <http://wiki.zimbra.com/wiki/OpenLDAP_MDB_vs_HDB_performance> There's also a ton more information at: <https://symas.com/lightning-memory-mapped-database/> Scroll to the bottom and look at the "Project presentations" section and the "Benchmarks" section, in addition to the rest of the useful information. ;) --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical