openldap-technical

openldap-technical@openldap.org

7 participants
9901 discussions

libldap and libldap_r in the same process
by Jan Engelhardt 27 Aug '16

27 Aug '16

A given (threaded) program makes use of libldap_r. It now also wants to make use of, say, libcurl. On certain systems, libcurl happens to be linked against libldap (not _r). Eventually, both libldap and libldap_r end up in the process image of my program, and a symbol like "ldap_init" may point to the function of either library file. The threaded program may end up unexpectedly been given the non-threaded functions, depending on how the runtime linker loaded said libraries and binds the symbols. (I am seeing crashes in a large program's initialization because of this.) There is a 7-year old post indicating libldap should get locking/ be replaced by libldap_r. http://www.openldap.org/lists/openldap-devel/200909/msg00018.html To date, openldap still consists of the two libraries. What are the preferred options to go forward here? * Killing non-threaded libldap in openldap for real If not, * Should curl have used -lldap_r instead of -lldap? * Should Linux distributions make libldap and libldap_r be the same thing? * Should libldap and libldap_r be augmented by ELF symbol versions? * All of the above? :)

1 0

Re: Using LMDB safely with fork() and exec()
by Howard Chu 23 Aug '16

23 Aug '16

Lorenz Bauer wrote: > If this works, I'd like to contribute the changes necessary to not > leak fds on exec, which are mentioned in the other thread. > > * Are there contribution guidelines somewhere? How do I submit a patch? Read http://www.openldap.org/ "Contributing" -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Re: mirror mode vs multi master
by Howard Chu 23 Aug '16

23 Aug '16

Matwey V. Kornilov wrote: > Hello, > >>From Administrator's guide, it is not completely clear what is the > internal difference between mirror mode and n-way multi master. There is no internal difference. The difference is in how clients use the servers. In mirrormode you arrange for all write ops to only go to one provider. > 1) Can 2-way multi master configuration exist? If so, what should be > difference in slapd.conf between mirror mode and 2-way multi master? There is no difference in slapd configuration. > What is the difference in syncrepl behaviour? Or all difference is > that external proxy/balancer assumed when mirror mode is meant? All difference is in the external proxy. > 2) Is there quorum based consensus when 3-way multi master is used? If > not, how is the conflict resolution performed? No quorums needed. Conflict resolution is based on CSNs. In general, last writer wins. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

mirror mode vs multi master
by Matwey V. Kornilov 23 Aug '16

23 Aug '16

Hello, >From Administrator's guide, it is not completely clear what is the internal difference between mirror mode and n-way multi master. 1) Can 2-way multi master configuration exist? If so, what should be difference in slapd.conf between mirror mode and 2-way multi master? What is the difference in syncrepl behaviour? Or all difference is that external proxy/balancer assumed when mirror mode is meant? 2) Is there quorum based consensus when 3-way multi master is used? If not, how is the conflict resolution performed? -- With best regards, Matwey V. Kornilov http://blog.matwey.name xmpp://0x2207@jabber.ru

1 0

search right and attribute existence
by Emmanuel Dreyfus 21 Aug '16

21 Aug '16

Hello I would like to test if an attribute is set without disclosing it. Using an ACL that grants the search right does it: I can do ldapsearch -b dn attr=*' dn and see if I get a result. Problem: it is still possible to brute force the atribute value, by searching x* with x being the first lette,r, then xy* and so on. Is there a way to address this? -- Emmanuel Dreyfus manu(a)netbsd.org

4 4

Directory structure searching
by Gurjot Kaur 19 Aug '16

19 Aug '16

Hi, I am encountered a problem regarding the checking of the directory structure during ldapsearch request. I did slapadd on my LDAP server (OpenLDAP 2.4.44 with MDB backend) for few entries and found the below error as my top entry "ou=people,dc=my-domain,dc=com" was missing from the DB. ############################################################################### /usr/local/sbin/slapadd -v -c -w -f /usr/local/etc/openldap/slapd.conf -l 2_tmp.ldif 578c3c23 mdb_monitor_db_open: monitoring disabled; configure monitor database to enable added: "ou=Test1,ou=people,dc=my-domain,dc=com" (00000005) added: "ou=Test2,ou=people,dc=my-domain,dc=com" (00000006) added: "ou=Test3,ou=people,dc=my-domain,dc=com" (00000007) added: "ou=Test4,ou=people,dc=my-domain,dc=com" (00000008) _#################### 100.00% eta none elapsed none fast! modified: "(null)" (00000001) Closing DB...Error, entries missing! entry 4: ou=people,dc=my-domain,dc=com ############################################################################### The above error is fine. Do the above entries get added to the DB, though the parent node for these entries was not present? Because when I search for the entry using the below ldapsearch command, this gives me the correct result. ############################################################################### ldapsearch -x -D cn=Manager, dc=my-domain,dc=com -w secret -b ou=Test1,ou=people, dc=my-domain,dc=com -s sub "(&(objectclass=organizationalUnit)(ou=Test1*))" -H ldap://0.0.0.0:2016 # extended LDIF # # LDAPv3 # base <ou=Test1,ou=people,dc=my-domain,dc=com> with scope subtree # filter: (&(objectclass=organizationalUnit)(ou=Test1*)) # requesting: ALL # # Test1, people, my-domain.com dn: ou=Test1,ou=people, dc=my-domain,dc=com ou: Test1 objectClass: organizationalUnit companyName: Test1 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 ############################################################################### Does this means ldapsearch check just for the specific entry and not the complete directory structure? Thanks in advance. Regards, Gurjot Kaur "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

2 1

Missing user entries after restoring a backup ldif
by Matt Spaulding 19 Aug '16

19 Aug '16

Hello, I restored an ldap database using the command: slapadd -l /my/file.ldif The restore went completely without error. But when I go to do an ldapsearch I find that some of the users that should be in the database are not there. I go back and edit my ldif backup file and search for the uids of the users and confirm that they are in fact in the ldif file. Why would something like this happen? Best Regards, Matt

2 1

Re: Can't modify pwdChangedTime as "admin"
by PenguinWhispererThe . 19 Aug '16

19 Aug '16

Thanks for that good pointer Dieter. Although it will force the user to change his password I'm not sure this will do the trick in our case. We have a custom passwd script that keeps both ldap and nis in sync. With the above I believe the Nis password won't be updated. So is there a way to actually update the pwdChangedTime? (Even out of pure curiosity) Thanks On Aug 17, 2016 11:38, "Dieter Klünter" <dieter(a)dkluenter.de> wrote: Am Wed, 17 Aug 2016 10:46:58 +0200 schrieb "PenguinWhispererThe ." <th3penguinwhisperer(a)gmail.com>: > Hi all, > > I've noticed that after a password reset pwdChangedTime gets updated. > > This is fine. We do have a policy in place that doesn't let you > modify your password again within a few days. > > I'd like to reset/change this pwdChangedTime so the user can reset his > password himself after logging in with the supplied password. However > deleting/modifying pwdChangedTime doesn't work. > > How should I resolve this? > I'm pretty sure this is not an ACL issue as my user matches the first > entry and is allowed to write all. > > I've seen some docs from IBM about removing pwdChangedTime being > possible but that might not apply to openldap. > man slapo-ppolicy(5), read carefully the comments on pwdReset. -Dieter -- Dieter Klünter | Systemberatung http://sys4.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

3 3

replicator account password encrypted and entries are hidden in ldap viewer
by Kruger, P (Justid) 18 Aug '16

18 Aug '16

We succesfully installed openldap with: - Replication - Password policy After applying config policy with olcPPolicyHashCleartext: TRUE the password the replicator user password gets encrypted with ssha. Although, according to what I've read, the password with simple bind should not be encrypted, it seems that replication still is functioning. Questions: Can anybody tell me if should be expected to cause a problem? How do you handle the replication user and password in regards to encrypted passwords? Second problem we are facing is that the replication OU and underlaying account are not visible anymore. With slapcat the OU is still visible in the LDIF file, but not in the LDAP viewer. If I'm not mistaken, the record is of the type GLUE, which might indicate that it is not properly replicated and therefore not visible? Question: Does anybody know what can be the problem here? Or how to solve this without reinstalling OpenLDAP with a clean database? Thanks in advance, Peter Kruger

2 1

Can't modify pwdChangedTime as "admin"
by PenguinWhispererThe . 17 Aug '16

17 Aug '16

Hi all, I've noticed that after a password reset pwdChangedTime gets updated. This is fine. We do have a policy in place that doesn't let you modify your password again within a few days. I'd like to reset/change this pwdChangedTime so the user can reset his password himself after logging in with the supplied password. However deleting/modifying pwdChangedTime doesn't work. How should I resolve this? I'm pretty sure this is not an ACL issue as my user matches the first entry and is allowed to write all. I've seen some docs from IBM about removing pwdChangedTime being possible but that might not apply to openldap. Thanks in advance!

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical