openldap-technical

openldap-technical@openldap.org

9 participants
9902 discussions

ldapsearch filter question
by Zhang,Jun 03 Jan '17

03 Jan '17

ldapsearch -x -b dc=myinstitute,dc=edu uid=user1 gidnumber gives me gidnumber=1234 I then tried, ldapsearch -x -b dc=myinstitute,dc=edu "(&(objectclass=groupofnames)(gidnumber=1234))" intending to find out the name of the group, but I got nothing. Thanks Jun The information contained in this e-mail message may be privileged, confidential, and/or protected from disclosure. This e-mail message may contain protected health information (PHI); dissemination of PHI should comply with applicable federal and state laws. If you are not the intended recipient, or an authorized representative of the intended recipient, any further review, disclosure, use, dissemination, distribution, or copying of this message or any attachment (or the information contained therein) is strictly prohibited. If you think that you have received this e-mail message in error, please notify the sender by return e-mail and delete all references to it and its contents from your systems.

4 8

Re: ppolicy overlay unable to set pwdAccountLockedTime on to-be-locked users due to ACLs
by Quanah Gibson-Mount 03 Jan '17

03 Jan '17

--On Monday, January 02, 2017 2:40 PM +0100 Matthieu Cerda <matthieu.cerda(a)nbs-system.com> wrote: > Thank you very much Quanah ! > > Do you think adding a note about mandatory rootdn setting in > slapo-ppolicy manpage would be a worthy contribution ? (I'll gladly > submit a patch) Hi Matthieu, It's already currently noted in the 3rd paragraph of the man page: Note that some of the policies do not take effect when the operation is performed with the rootdn identity; all the operations, when performed with any other identity, may be subjected to constraints, like access control. Note the bit about "all the operations, ..." If you think of a way to reword it that you feel is a better explanation, that could certainly be considered. :) Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 2

Fwd: Help pls : KDC w/LDAP backend
by Pascal Jakobi 02 Jan '17

02 Jan '17

Hi there I am trying to install a KDC (kerberos) with an OpenLDAP backend, following instructions found on the MIT kerberos site. Installation went fine and I can see that the default principals have been created (kadmin, krbtgt & so on...). However, I cannot add new principals : kadmin.local -q "addprinc -pw password root" Authenticating as principal root/admin(a)JAKOBI.FR with password. WARNING: no policy specified for root(a)JAKOBI.FR; defaulting to no policy *add_principal: Principal add failed: Insufficient access while creating "root(a)JAKOBI.FR <root(a)JAKOBI.FR>".* Digging a bit further, I could see the following with wireshark (after binding to the Directory as kadmin) : 147 21.719670222 127.0.0.1 127.0.0.1 LDAP 1028 addRequest(7) "krbprincipalname=root(a)JAKOBI.FR,cn=JAKOBI.FR,cn=kerberos,dc=jakobi,dc=fr" 148 21.720138441 127.0.0.1 127.0.0.1 LDAP 107 addResponse(7) *insufficientAccessRights (no write access to parent) * My LDAP ACLs are as follows : {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=jakobi,dc=fr" write by anonymous auth by self write by * none {1}to dn.base="" by * read {2}to * by dn="cn=admin,dc=jakobi,dc=fr" write by * read {3}to dn.subtree="cn=JAKOBI.FR,cn=kerberos,dc=jakobi,dc=fr" by dn.exact="cn=kdc,ou=People,dc=jakobi,dc=fr" read * {4}to dn.subtree="cn=kerberos,dc=jakobi,dc=fr" by dn.exact="cn=kadmin,ou=People,dc=jakobi,dc=fr" write* if ACL #4 refers to *dn.subtree="**cn=JAKOBI.FR <http://JAKOBI.FR>,cn=kerberos,dc=jakobi,dc=fr"* (shouldn'it be the parent of the target principal?), result is the same. As far as I understand, rule #4 should allow me to to write within the realm subtree... Can someone enlighten me ? Thanks in adv. -- *Pascal*

3 2

Re: ppolicy overlay unable to set pwdAccountLockedTime on to-be-locked users due to ACLs
by Quanah Gibson-Mount 02 Jan '17

02 Jan '17

--On Thursday, December 22, 2016 11:23 AM +0100 Matthieu Cerda <kegeruneku+openldap(a)ironflake.org> wrote: > Hello Howard and Ozgur, > > My answers are inlined in the following text. > > I attached a copy of the slapd.conf if you would like to take a look. Your slapd.conf has no rootdn configured. You need to configure it if you want ppolicy to function correctly. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: memberOf overlay issues with 2.4.44 + ITS 8432 patch
by Quanah Gibson-Mount 02 Jan '17

02 Jan '17

Ok good to know! The issue I created occurred when deleting the group, which I believe is the original complaint in the ITS as well. So I will add individual membership deletes as a part of that test too. --Quanah > On Dec 30, 2016, at 9:31 PM, Paul B. Henson <henson(a)acm.org> wrote: > >> On Fri, Dec 30, 2016 at 02:41:06PM -0800, Quanah Gibson-Mount wrote: >> >> Well, it seems to be some sort of race condition. > > Yes, I'd agree; probably also load dependent as I never triggered it on > my dev systems which are mostly idle other than my test load. It only > showed up on my prod systems which tend to have continuous load from > various other things. > >> I did want to confirm that you see this on servers that are long running >> (I.e., they've been running for a long time, and had other group deletes >> that went through w/o issue during that time). If so, then I can modify >> the test to randomly add and delete groups as a part of the test, >> increasing the likelyhood of triggering the issue within the test. > > I don't have too many deletions of group objects themselves in > production, mostly just deletions of the members of groups. I didn't see > any issues with group deletions in dev, or during some basic initial > testing in prod. I'll go ahead and make a new test group, add some > members to it, and then delete it and see what happens now that I've > been running this code for about 3 weeks... > > I didn't see any errors deleting a group, although there were these > syncrepl messages that I don't believe used to show up: > > Dec 30 21:23:29 themis slapd[2607]: syncrepl_message_to_op: rid=001 be_delete uid=ldaptest5,ou=group,dc=cpp,dc=edu (32) > Dec 30 21:23:29 themis slapd[2607]: syncrepl_message_to_op: rid=003 be_delete uid=ldaptest5,ou=group,dc=cpp,dc=edu (32) > Dec 30 21:23:29 themis slapd[2607]: syncrepl_message_to_op: rid=002 be_delete uid=ldaptest5,ou=group,dc=cpp,dc=edu (32) > > The group and memberOf attributes are gone on all four servers, so other > than noise in the logs I'm not sure what these messages meant. > >

2 1

Re: memberOf overlay issues with 2.4.44 + ITS 8432 patch
by Quanah Gibson-Mount 30 Dec '16

30 Dec '16

--On Thursday, December 29, 2016 7:55 PM -0800 "Paul B. Henson" <henson(a)acm.org> wrote: > On Thu, Dec 29, 2016 at 04:48:42PM -0800, Quanah Gibson-Mount wrote: > >> I'm able to reproduce the problem with my test script, so I think things >> are set from here. > > Excellent; in that case please let me know when there is a fix available > :). Thanks much... Well, it seems to be some sort of race condition. I've only had it occur one time out of some 700+ attempts. I don't think it is really related to 4-way MMR at all, but it may be the larger the number of consumers of the accesslog, the more likely it is to occur (so you'll see it more often in 4-way MMR). I did want to confirm that you see this on servers that are long running (I.e., they've been running for a long time, and had other group deletes that went through w/o issue during that time). If so, then I can modify the test to randomly add and delete groups as a part of the test, increasing the likelyhood of triggering the issue within the test. Thanks, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: memberOf overlay issues with 2.4.44 + ITS 8432 patch
by Quanah Gibson-Mount 29 Dec '16

29 Dec '16

--On Wednesday, December 28, 2016 4:44 PM -0800 "Paul B. Henson" <henson(a)acm.org> wrote: > On Wed, Dec 28, 2016 at 09:53:23AM -0800, Quanah Gibson-Mount wrote: > >> I'm going to see if I can create a test that reproduces the issue. >> I've been working on expanding the test suite so we can ensure we >> avoid regressions etc. > > Cool, thanks. Let me know if there's anything I can do to help. I'm able to reproduce the problem with my test script, so I think things are set from here. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: memberOf overlay issues with 2.4.44 + ITS 8432 patch
by Quanah Gibson-Mount 28 Dec '16

28 Dec '16

--On Thursday, December 22, 2016 6:12 PM -0800 "Paul B. Henson" <henson(a)acm.org> wrote: >> Probably worth adding to ITS#8444. > > Ok, will do. Although it seems there's been no response to that ticket > for six months :(? Anything else I can provide to help debug this? > Unfortunately it doesn't seem to be a straight "always happens" bug, I > didn't see it all in my dev environment under a test load, it only > popped up in production under a full load. I'm going to see if I can create a test that reproduces the issue. I've been working on expanding the test suite so we can ensure we avoid regressions etc. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: 2.4.44 segfault in modify_add_values
by Quanah Gibson-Mount 28 Dec '16

28 Dec '16

--On Sunday, December 25, 2016 8:19 AM -0800 "Paul B. Henson" <henson(a)acm.org> wrote: > Woke up this morning to an unwanted Christmas present :(, one of my ldap > servers had crashed with a segfault: > I restarted it and it synced right back up from the failover master and > seems to be ok now. Does this pop out as anything known and possibly > resolved in head? Thanks... Doesn't ring a bell, and unfortunately it looks like your binaries are stripped, so the backtrace doesn't contain useful information. :( --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Bulk change user's attribute
by Quanah Gibson-Mount 28 Dec '16

28 Dec '16

--On Friday, December 23, 2016 11:39 AM +0000 Bruno Miguel Martins <bruno.miguel.martins(a)iten.pt> wrote: > > > Hello guys, > > > > I am running slapd 2.3.30 and I need to bulk modify one LDAP attribute > (sambaHomePath) for all of my users, like: > > > > Current value = \\oldserver\username > > New value = \\newserver\username > > > > Can this be done? Basically I need a partial change of that attribute – > "oldserver" which is variable, changed with "newserver" which is > fixed. Other than the fact that 2.3.30 is ancient and unsupported... You should be able to do this, yes. You could use a scripting module such as Net::LDAP in Perl. If it is possible to do a substring query on the attribute in question, you could use a filter of "(attr=*oldserver*)" to get a set of entries back, and then iterate over them and do the update in the script. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical