openldap-technical

openldap-technical@openldap.org

12 participants
9794 discussions

01 Feb '17

I have inherited an LDAP server and admittedly do not have all the technical expertise to troubleshoot the problems we have. We are using slapd 2.4.40. The first problem is nobody but the rootdn can change passwords. We'd like to use "passwd" utility on our servers to change our passwords but the error is "LDAP password information update failed: Insufficient access" In slapd.conf we have (i have removed our dc for privacy): access to attrs=userPassword by self write by anonymous auth by dn="cn=Manager,dc=X,dc=Y,dc=Z" write by * none access to * by self write by dn="cn=Manager,dc=X,dc=Y,dc=Z" write by * read by * auth access to * by dn="uid=ldapadmin,dc=X,dc=Y,dc=Z" read "cn=Manager,dc=X,dc=Y,dc=Z" is our rootdn and i have enabled logleve 128 However, this brings me to the next problem: the contents of slapd.conf do not match the slapd.d/cn\=config.ldif file, so it seems the fixes i am trying to the ACL's don't have any effect, even when i restart slapd. If i try "ldapmodify -nv" it just hangs. When i try to stop slapd and remove slapd.d/* and then start slapd, the contents are recreated according to the config file, but then users can't login (all i see in the logfile is access_allowed and slap_access_allowed but no conn lines) So some basic troubleshooting help would be appreciated! Thanks

2 1

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 01 Feb '17

01 Feb '17

--On Tuesday, January 31, 2017 10:49 PM +0100 "A. Schulze" <sca(a)andreasschulze.de> wrote: > > > Am 30.01.2017 um 21:49 schrieb Quanah Gibson-Mount: >> Optionally, cd tests && make its run through the regression suite. > > this set of tests pass, but I noticed one line: > > ./data/regressions/its8521/its8521: 268: test: 1: unexpected operator Thanks, fixed! --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 01 Feb '17

01 Feb '17

--On Tuesday, January 31, 2017 10:21 PM +0100 "A. Schulze" <sca(a)andreasschulze.de> wrote: > > > Am 30.01.2017 um 21:49 schrieb Quanah Gibson-Mount: >> <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=re >> fs/heads/OPENLDAP_REL_ENG_2_4;sf=tgz> >> >> Configure & build. > > * I noticed 33x "warning: unused variable" > should I write a patch? Patch + ITS would be best. ;) > * Very interesting to me how you modified my patch > http://www.openldap.org/its/index.cgi?findid=8533 ... Thanks! Thanks go to Howard. ;) > * This (and earlier) openldap-releases do not force server side cipher > preference. there is a technical simple way to achieve this: > > --- a/libraries/libldap/tls_o.c > +++ b/libraries/libldap/tls_o.c > @@ -366,6 +366,8 @@ tlso_ctx_init( struct ldapoptions *lo, s > } > } > #endif > + /* maybe some # ifdef is needed */ > + SSL_CTX_set_options( ctx, SSL_OP_CIPHER_SERVER_PREFERENCE ); > return 0; > } > > As far as I know there is no ITS item opened. It it worth to add one? I would suggest filing an ITS, yes. > * An other point I'm interested is compilation of libraries/liblmdb/mdb_* > tools. While all other binaries are build using external defined CFLAGS > and LDFLAGS "make -C libraries/liblmdb/" use other values. > > Any chance, these tools are integrated in the common build process > maybe enabled/disabled by a ./configure option? LMDB is standalone software, so it's generally designed to be buildable on its own. What CFLAGS/LDFLAGS do you feel would be necessary to pass through? > * compilation against openssl-1.1.0d works without issues and at a first > startup it also work :-) I'll report on further success... > > * but last: make test failed > ( attached make_test_result.txt ) I'll see if I can repo the test058 failure. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 31 Jan '17

31 Jan '17

--On Tuesday, January 31, 2017 12:05 PM -0800 Quanah Gibson-Mount <quanah(a)symas.com> wrote: >> ERROR: Entry 21 not replicated to ldap://localhost:9012/! (32)! >> Error found after 1 of 1 iterations >>>>>>> test061-syncreplication-initiation failed for mdb >> (exit 1) >> Makefile:310: recipe for target 'mdb-yes' failed >> make: *** [mdb-yes] Error 1 > > Interesting -- Can you tar up the testrun directory, ftp it up, and file > an ITS with a pointer to the upload? I was able to reproduce this as well with back-mdb. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 31 Jan '17

31 Jan '17

--On Tuesday, January 31, 2017 8:35 PM +0100 Dieter Klünter <dieter(a)dkluenter.de> wrote: > Am Mon, 30 Jan 2017 12:49:56 -0800 > schrieb Quanah Gibson-Mount <quanah(a)symas.com>: > [...] > >> Generally, get the code for RE24: >> >> <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=re >> fs/heads/OPENLDAP_REL_ENG_2_4;sf=tgz> >> >> Configure & build. >> >> Execute the test suite (via make test) after it is built. >> Optionally, cd tests && make its run through the regression suite. > > [...] > > Starting test061-syncreplication-initiation for mdb... > Running defines.sh > ... > > ERROR: Entry 21 not replicated to ldap://localhost:9012/! (32)! > Error found after 1 of 1 iterations >>>>>> test061-syncreplication-initiation failed for mdb > (exit 1) > Makefile:310: recipe for target 'mdb-yes' failed > make: *** [mdb-yes] Error 1 Interesting -- Can you tar up the testrun directory, ftp it up, and file an ITS with a pointer to the upload? Thanks, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Mirror Inquiry
by Standalone Admin 31 Jan '17

31 Jan '17

Hi Is there a need for more mirrors for OpenLDAP? If so we can host it on our server in France @1GBPS connection. Thanks, Sam

1 0

How to add index for "member" of ldap groups
by Axel Birndt 27 Jan '17

27 Jan '17

Hi @All, i'am currently searching for a possibility to add an index in openldap (cn=config backend) for the "member" of groups. In my log i got the following message: > 475 admin slapd: <= bdb_equality_candidates: (member) not indexed I found, that "member" is an attribute from an ldap group. > # Entry 1: cn=bind_users,ou=admins,ou=groups,dc=company,dc=de > dn: cn=bind_users,ou=admins,ou=groups,dc=company,dc=de > cn: bind_users > member: cn=apachebind,ou=apache_technical,ou=users,dc=company,dc=de > member: cn=wordpressbind1,ou=wordpress_bind,ou=users,dc=company,dc=de > objectclass: groupOfNames > objectclass: top How could i add an index for this attribute? I searched with google and found: http://www.openldap.org/faq/data/cache/136.html https://wiki.debian.org/LDAP/OpenLDAPSetup http://www.openldap.org/doc/admin24/slapdconf2.html and so on... With this information i already added indices for > # Entry 1: olcDatabase={1}hdb,cn=config > dn: olcDatabase={1}hdb,cn=config > objectclass: olcDatabaseConfig > objectclass: olcHdbConfig > olcdbindex: objectClass eq > olcdbindex: cn pres,sub,eq > olcdbindex: sn pres,sub,eq > olcdbindex: uid pres,sub,eq > olcdbindex: displayName pres,sub,eq > olcdbindex: default sub > olcdbindex: uidNumber eq > olcdbindex: gidNumber eq > olcdbindex: mail,givenName eq,subinitial > olcdbindex: dc eq If i try to add a new index "olcdbindex: member pres,sub,eq" i got an failure Could not perform ldap_modify operation. LDAP said: Other (e.g., implementation specific) error Error number: 0x50 (LDAP_OTHER) Is anyone able to give me a hint, where i could find more information or help me to find the right search key words? -- Gruß/Kind regards Axel ------------------------------

2 2

Re: Antw: How to add index for "member" of ldap groups
by Axel Birndt 27 Jan '17

27 Jan '17

Am 27.01.2017 um 08:24 schrieb Ulrich Windl: >>>> Axel Birndt <towerlexa(a)gmx.de> schrieb am 26.01.2017 um 22:17 in Nachricht > <858439a0-ab4f-cea3-f5ea-9b8f3514d08b(a)gmx.de>: >> Hi @All, >> >> i'am currently searching for a possibility to add an index in openldap >> (cn=config backend) for the "member" of groups. >> >> In my log i got the following message: >> >> > 475 admin slapd: <= bdb_equality_candidates: (member) not indexed >> >> I found, that "member" is an attribute from an ldap group. >> >> > # Entry 1: cn=bind_users,ou=admins,ou=groups,dc=company,dc=de >> > dn: cn=bind_users,ou=admins,ou=groups,dc=company,dc=de >> > cn: bind_users >> > member: cn=apachebind,ou=apache_technical,ou=users,dc=company,dc=de >> > member: cn=wordpressbind1,ou=wordpress_bind,ou=users,dc=company,dc=de >> > objectclass: groupOfNames >> > objectclass: top >> >> How could i add an index for this attribute? > > Maybe via LDIF: > dn: olcDatabase={1}hdb,cn=config > changetype: modify > add: olcDbIndex > olcDbIndex: member eq > Hi Ulrich, thanks for your hint! I could solve it with your LDIF snippet! -------------- dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcDbIndex olcDbIndex: member eq ------------------ It is running fine: -------------------------- abirndt@admin:~/openldap$ sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f olcDbIndex_member.ldif [sudo] password for abirndt: SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={1}hdb,cn=config" --------------------- -- Gruß/Kind regards Axel ------------------------------

1 0

Re: Difference between root and directory manager
by Quanah Gibson-Mount 27 Jan '17

27 Jan '17

--On Thursday, January 26, 2017 5:53 PM +0300 Tamer Ataol <ataoltamer(a)gmail.com> wrote: > > > > Hi, > > Can you explain the difference between root user of openldap and > directory manager? Specifically where do we use the root user and > password in openldap administration? Hi, Your question makes little sense. "root" is a unix user. It may or may not (depending on the slapd configuration) have the ability to directly manipulate data in the LDAP server. That would depend entirely on your configuration. There is no such thing as a specific "directory manager". There /may/ be a rootdn defined for the various databases, that may or may not be identical per database. There may also be access rules that allow other DNs to provide management functions. Without details on your configuration/setup, there's no way to answer your question. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Has anybody benchmarked OpenLDAP as an Object Storage Service?
by Howard Chu 26 Jan '17

26 Jan '17

John Lewis wrote: > I am wondering if anybody has benchmarked OpenLDAP as a generic network object > storage service. I know Networked Key Value Databases are getting more popular > because they seem to scale laterally better. Probably nothing recent. Back in the CORBA days it was probably a frequent event. > Most of the so called NoSQL databases use some kind of JSON over HTTPS network > transport. I like the idea of using something LDAP based because of the IETF > standardized interface lowers the risk of sudden changes to the interface > forcing a program change, kind of like how Microsoft broke Skype calls for > Blog Talk Radio. LDAP isn't a Key/Value database; it could be used as one but there would be a lot of unnecessary overhead - much like using SQL as only a Key/Value database. The value in using LDAP comes from mapping an application's higher level data model onto LDAP entries. Not just individual keys and blob values. > I know Howard Chu has been reporting a lot of awful but true things about > MongoDB over the last couple of years. > https://twitter.com/hyc_symas/status/664197817498509312 > https://twitter.com/hyc_symas/status/740339320645689344 > https://twitter.com/hyc_symas/status/817696625313349632 > > What I would really want to see is some numbers comparing OpenLDAP to > networked key value databases that are in production such as Reddit's two > table Postgres > <https://kev.inburke.com/kevin/reddits-database-has-two-tables/> or Redis or > even HBase from Hadoop. Could probably rig up a YCSB test without too much trouble. Frankly though I've got very low confidence in any java-based benchmark utility. Our experience with java-based SLAMD over the years has shown that it vastly underreports OpenLDAP's performance simply because SLAMD/java are not efficient enough to drive high enough loads at slapd. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical