openldap-technical

openldap-technical@openldap.org

13 participants
9795 discussions

Re: Provider-Consumer replication 2.4 OLC (second attempt)
by Quanah Gibson-Mount 27 Oct '16

27 Oct '16

--On Tuesday, October 25, 2016 11:34 AM -0400 Ted Hyde <laserted(a)gmail.com> wrote: > Greets - (first post, second time. Don't know if it's being moderated or > dropped, will keep trying). It ended up in my spam folder for some reason. > After installation, I have two functioning standalone servers. During my > research, I found two conflicting pieces of information. I prefer to > perform "refreshOnly" instead of "refreshAndPersist", so some sources say > ONLY the consumers need configuration, a couple said both sides need > configuration AND a number of additional indices. This is likely where my > problems arise. I strongly advise only using refreshAndPersist. I'm not sure why you are referring to random how-not-to-do things on the interweb. You should use the OpenLDAP admin guide: <http://www.openldap.org/doc/admin24/replication.html> > Any thoughts? Read the admin guide, as noted above. The examples are still slapd.conf, but you can trivially translate those to what are necessary for cn=config. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Account computer
by Kwame Bahena 27 Oct '16

27 Oct '16

LOL. Don't get upset. You didn't mention at first that you are using samba with OpenLDAP. Take a look at this link http://lmgtfy.com/?q=disable+inactive+accounts+Samba+with+OpenLDAP On Thu, Oct 27, 2016 at 12:33 PM, Itamar S. <immaggoo(a)gmail.com> wrote: > > 2016-10-27 15:32 GMT-02:00 Itamar S. <immaggoo(a)gmail.com>: > >> Fk you. >> >> If I had a CD would have done. I'm using Samba with OpenLDAP. >> > > Fk you. > > If I had a AD would have done. I'm using Samba with OpenLDAP. >

1 0

Account computer
by Itamar S. 27 Oct '16

27 Oct '16

Hello, How can I disable accounts computer that have been inactive for 180 days?

3 2

Proxy cache not work with <attribute not in schema>
by JWD 27 Oct '16

27 Oct '16

slapd 2.4.40 Windows AD as proxy backend. I found any query match <pcacheTemplate>+<pcacheAttrset>+<attribute not in schema> will answer <pcacheAttrset> value only, <attribute not in schema> will be ignored. This is not what I expected, I need <attribute not in schema> too. But query anything else that not in cache, <attribute not in schema> will be cached. Log message like this: 580ec506 PROXIED attributeDescription "PRIMARYGROUPID" inserted. And after that, query match <pcacheTemplate>+<pcacheAttrset>+<attribute not in schema> will answer <attribute not in schema> too. This is what I expected. Do I have to add schema for <attribute not in schema>? Is there any other way to make <attribute not in schema> CACHEABLE? -------------- JWD

2 2

Re: delta-synrepl consumer randomly delete objects
by Quanah Gibson-Mount 26 Oct '16

26 Oct '16

--On Thursday, October 20, 2016 10:19 AM +0200 Raffael Sahli <public(a)raffaelsahli.com> wrote: > Hi > > What can lead a consumer to "randomly" delete ~50% of all objects in his > database? I have this problem now for ~1-2months and on 3 different > master/slave groups. > > The consumer starts to delete objects (but those are all present on the > master): > > Oct 19 17:16:22 ldap-slave002.xxx slapd[8554]: do_syncrep2: rid=999 > LDAP_RES_INTERMEDIATE - SYNC_ID_SET Oct 19 17:16:22 ldap-slave002.xxx This is not delta-syncrepl, this is syncrepl. What triggered your system to fall back to syncrepl? --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

openldap access control order behavior
by vvv jjj 26 Oct '16

26 Oct '16

Hi OpenLDAP team, I'm new to OpenLDAP and trying to learn the configuration from the openldap provided document. Please let me know if I'm posting my question in a wrong form. The question may be trivial but I was looking for the behavior which I'm not clear. My question is, does the access control order effect the behavior. That is, Is there any change in behavior for the below 2 access control commands. 1. access to * by users read by anonymous read access to dn.base=ACL by users read 2. access to dn.base=ACL by users read access to * by users read by anonymous read Please let me know your comments. Let me know if anything is not clear. Thanks for support. Regards J.Visu

2 4

Re: ditContentRule + cn=config
by Quanah Gibson-Mount 25 Oct '16

25 Oct '16

--On Tuesday, October 25, 2016 6:28 PM +0200 Dieter Klünter <dieter(a)dkluenter.de> wrote: > Hi, > it seems that slapd, starting with -F, is not able to read schema > information, prior to cn=config, > ./slapd -h "ldap://:9007/ ldapi:///" -F ../etc/openldap/slapd.d -d256 > 580f76bd config error processing cn=config: olcDitContentRules: > ObjectClass not found: "2.16.840.1.113730.3.2.2" 580f76bd slapd stopped. > > but with -f schema information is read > prior to global and database specific configuration. > ./slapd -h "ldap://:9007/ ldapi:///" -f ../etc/openldap/slapd.conf -d256 > 580f76e4 slapd starting > > Has this been fixed already? although I couldn't find a report in ITS. I doubt it has been fixed. I suggest filing an ITS with configuration(s) that reproduce the issue. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: openldap 2.4.40 ppolicy module and shadowInactive equivalent
by Quanah Gibson-Mount 25 Oct '16

25 Oct '16

Hi Elizabeth, You would likely need to compile it yourself, as I'm not aware of any distributions that ship NSSOV (although some may). There is more information on it here: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=contrib/sl…> Hope that helps! Regards, Quanah --On Tuesday, October 25, 2016 5:09 PM +0000 "Real, Elizabeth (392K)" <Elizabeth.Real(a)jpl.nasa.gov> wrote: > > > Quanah, > > > > I found little information on this contrib nssov overlay: > http://www.openldap.org/doc/admin24/guide.html#nssov > > > > How do you implement it? Is it similar to adding the ppolicy overlay? > > > > > Thank you, > > Liz > > > > From: Quanah Gibson-Mount <quanah(a)symas.com> > Reply-To: Quanah Gibson-Mount <quanah(a)symas.com> > Date: Monday, October 24, 2016 at 6:29 PM > To: "Real, Elizabeth (392K)" <Elizabeth.Real(a)jpl.nasa.gov>, > "openldap-technical(a)openldap.org" <openldap-technical(a)openldap.org> > Subject: Re: openldap 2.4.40 ppolicy module and shadowInactive equivalent > > > > > --On Monday, October 24, 2016 7:43 PM +0000 "Real, Elizabeth (392K)" > > <Elizabeth.Real(a)jpl.nasa.gov> wrote: > > > > > > I setup a password policy overlay on my openldap 2.4.40 servers running > > RHEL7. I need to enforce the following: disable accounts that have been > > inactive for 180 days. In the past we were able to do this by simply > > adding the shadowInactive attribute to each account: shadowInactive 180. > > But with the new openldap, it appears there is no equivalent attribute?? > > > > > > OpenLDAP ppolicy has never supported that attribute, as far as I know. I > > believe you are looking for the contrib nssov overlay, which does support > > it. > > > > Hope that helps! > > > > Regards, > > Quanah > > > > > > > > -- > > > > Quanah Gibson-Mount > > Product Architect > > Symas Corporation > > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > > <http://www.symas.com> > > > > -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: openldap 2.4.40 ppolicy module and shadowInactive equivalent
by Quanah Gibson-Mount 25 Oct '16

25 Oct '16

--On Monday, October 24, 2016 7:43 PM +0000 "Real, Elizabeth (392K)" <Elizabeth.Real(a)jpl.nasa.gov> wrote: > I setup a password policy overlay on my openldap 2.4.40 servers running > RHEL7. I need to enforce the following: disable accounts that have been > inactive for 180 days. In the past we were able to do this by simply > adding the shadowInactive attribute to each account: shadowInactive 180. > But with the new openldap, it appears there is no equivalent attribute?? OpenLDAP ppolicy has never supported that attribute, as far as I know. I believe you are looking for the contrib nssov overlay, which does support it. Hope that helps! Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

ditContentRule + cn=config
by Dieter Klünter 25 Oct '16

25 Oct '16

Hi, it seems that slapd, starting with -F, is not able to read schema information, prior to cn=config, ./slapd -h "ldap://:9007/ ldapi:///" -F ../etc/openldap/slapd.d -d256 580f76bd config error processing cn=config: olcDitContentRules: ObjectClass not found: "2.16.840.1.113730.3.2.2" 580f76bd slapd stopped. but with -f schema information is read prior to global and database specific configuration. ./slapd -h "ldap://:9007/ ldapi:///" -f ../etc/openldap/slapd.conf -d256 580f76e4 slapd starting Has this been fixed already? although I couldn't find a report in ITS. -Dieter -- Dieter Klünter | Systemberatung http://sys4.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical