openldap-technical

openldap-technical@openldap.org

5 participants
9963 discussions

TLS init: ca md too weak
by Uwe Sauter 17 Apr '24

17 Apr '24

Hi all, one of my Rocky Linux 8 servers was updated automatically to 2.6.7 this night from the Symas repo. The install script seems to include an automated restart of the service but that failed with: main: TLS init def ctx failed: -1 error:0A00018E:SSL routines::ca md too weak As this is an internal network with a private CA the strength of the CA is of minor relevance. I think the change comes with symas-openssl-libs-3.0.8-1.el8.x86_64… Can anyone suggest a workaround (other than exchanging the CA and its issued certificates)? Thanks, Uwe

3 3

RE25 testing call (2.5.18) #1
by Quanah Gibson-Mount 16 Apr '24

16 Apr '24

his is the first testing call for OpenLDAP 2.5.18. Depending on the results, this may be the only testing call. Generally, get the code for RE25: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.5.18 Engineering Fixed libldap exit handling with OpenSSL3 again (ITS#9952) Fixed slapd-meta with dynlist (ITS#10164) Fixed slapd-meta binds when proxying internal op (ITS#10165) Fixed slapo-accesslog startup initialization (ITS#10170) Fixed slapo-dynlist with abandoned operations (ITS#10044) Build Fixed build with gcc14.x (ITS#10166) Fixed back-perl with clang15 (ITS#10177) Minor Cleanup ITS#10171 ITS#10173 ITS#10179 ITS#10186 Regards, Quanah

1 0

Used rewriteMap with different uri
by lsoulas 11 Apr '24

11 Apr '24

Hi, I want used slapo-rwm to redirect a rule in a different URI. Here my configuration : /database meta suffix "dc=lan" uri "ldaps://server1/dc=lan" / /rewriteEngine on rewriteContext default rewriteRule ".*" ".*" ":" rewriteMap ldap attr2dn "ldap://server2/dc=lan?dn?sub" rewriteContext bindDN rewriteRule ".*" "${attr2dn($0)}" ":@I"/ I d'ont really understand rewrite map. Can you explain me. According to the documentation, it seems to be feasible. Thanks -- *Loïc Soulas* *ILIWI* /(https://www.iliwi.fr)/ lsoulas(a)iliwi.fr +33(0)662 249 445 ILIWI - Audit et solutions réseau informatique

1 0

Help debugging slave slapd issues
by BECOT Jérôme 04 Apr '24

04 Apr '24

Hello, On all different OpenLDAP 2.4 and 2.5 slaves of 2.4 servers, we see a lot of deferring errors: slapd[37277]: connection_input: conn=32974 deferring operation: too many executing or slapd[37277]: connection_input: conn=32974 deferring operation: pending operations Can you give any hints about way to debug what causes these messages ? (which log level should I aim for and witch system settings should I check) I can provide more details then. Regards Jerome

6 9

Permissive Modify and mdb
by lesignor＠cirad.fr 02 Apr '24

02 Apr '24

Hi, I try to modify an entry with permissive modify control. The response is protocole error : permissiveModify control value not absent. I check with wireshark the request, and there was no value with the control, but the control was marked as critical. The problem appears with openldap 2.5.x and 2.6.x with mdb database. It is ok with openldap 2.4.x with bdb database. So is the permissive modify control supported with mdb database in openldap >= 2.5.x ? Thank for your help

2 2

kerberos-cache location
by Stefan Kania 02 Apr '24

02 Apr '24

I normally use Debian for OpenLDAP and Kerberos, but now I have to uses Alamalinux 9. When I create a Ticket with kinit I'm getting: --------- u1-prod@ldapserver1 ~]$ kinit Password for u1-prod(a)EXAMPLE.NET: [u1-prod@ldapserver1 ~]$ klist Ticket cache: KCM:10001 Default principal: u1-prod(a)EXAMPLE.NET --------- So the ticket cache is the KCM-daemon and not FILE: like in Debian. When I die an ldapsearch or an ldapwhoami I'm getting ----------- [u1-prod@ldapserver1 ~]$ ldapwhoami SASL/GSSAPI authentication started ldap_sasl_interactive_bind: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Miscellaneous failure (see text) (get-principal lstat(/tmp/krb5cc_10001)) ----------- All the ldap-commands are looking for the credential cache in FILE: and not in KCM: I'm using OpenLDAP 2.6 from the repositories. Is there a way that the ldap-commands are using KCM:?

3 5

Strange search result in logs
by Frédéric Goudal 27 Mar '24

27 Mar '24

Hello, I’m trying to analyse the requests done to my ldapserver from a nas. While browsing the logs I found the following entries : Mar 27 09:35:45 ldapd2021 slapd[3670819]: conn=2910400 fd=38 ACCEPT from IP=10.220.18.3:47000 (IP=0.0.0.0:636) Mar 27 09:35:45 ldapd2021 slapd[3670819]: conn=2910400 fd=38 TLS established tls_ssf=256 ssf=256 tls_proto=TLSv1.2 tls_cipher=ECDHE-RSA-AES256-GCM-SHA384 Mar 27 09:35:45 ldapd2021 slapd[3670819]: conn=2910400 op=0 BIND dn="" method=128 Mar 27 09:35:45 ldapd2021 slapd[3670819]: conn=2910400 op=0 RESULT tag=97 err=0 qtime=0.000014 etime=0.000110 text= ….. Mar 27 09:37:43 ldapd2021 slapd[3670819]: conn=2910400 op=720 SRCH base="ou=people,dc=ipb,dc=fr" scope=1 deref=0 filter="(&(objectClass=posixAccount)(gidNumber=*)) Mar 27 09:37:43 ldapd2021 slapd[3670819]: conn=2910400 op=720 SRCH attr=gidNumber Mar 27 09:37:43 ldapd2021 slapd[3670819]: conn=2910400 op=720 SEARCH RESULT tag=101 err=4 qtime=0.000007 etime=0.000224 nentries=1 text= But if I do the same seach : Mar 27 09:58:34 ldapd2021 slapd[3670819]: conn=2911004 fd=31 ACCEPT from IP=127.0.0.1:56536 (IP=0.0.0.0:636) Mar 27 09:58:34 ldapd2021 slapd[3670819]: conn=2911004 fd=31 TLS established tls_ssf=256 ssf=256 tls_proto=TLSv1.3 tls_cipher=TLS_AES_256_GCM_SHA384 Mar 27 09:58:34 ldapd2021 slapd[3670819]: conn=2911004 op=0 BIND dn="" method=128 Mar 27 09:58:34 ldapd2021 slapd[3670819]: conn=2911004 op=0 RESULT tag=97 err=0 qtime=0.000008 etime=0.000040 text= Mar 27 09:58:34 ldapd2021 slapd[3670819]: conn=2911004 op=1 SRCH base="ou=people,dc=ipb,dc=fr" scope=1 deref=0 filter="(&(objectClass=posixAccount)(gidNumber=*))" Mar 27 09:58:34 ldapd2021 slapd[3670819]: conn=2911004 op=1 SRCH attr=gidNumber Mar 27 09:58:34 ldapd2021 slapd[3670819]: conn=2911004 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000011 etime=0.054003 nentries=5206 text= I have no specific ACL on the ip quering. What I see is that in the first case I have err=4, from what I have found it means size limit exceeded. Do you have an explanation of the first anwser ? Is there any param that can be in the request to cause the err=4 ? Maybe I should rise the logLevel to find the difference between the two requests ? Thanks in advance for any hint... — Frédéric Goudal Ingénieur Système, DSI Bordeaux-INP +33 556 84 23 11

3 3

how to migrate an openldap server to a new linux server
by xpzhang1971＠gmail.com 26 Mar '24

26 Mar '24

I have an openldap server I want to clone it to another linux server. However, I can't access it by login but can just run ldapsearch because this source openldap server only open port 389. Now I installed openldap-servers package to target linux server, then what? I appreciate if anybody can instruct me or direct me to useful documents.

5 14

etensibleObject vs. creating a new schema
by Uwe Sauter 26 Mar '24

26 Mar '24

Hi all, I was wondering if there is any best practice when to use extensibleObject in contrast to creating new objectClasses within a local schema. E.g. I have the need to filter the visibility of posixGroups depending on some attribute when sssd is accessing the directory. What I could do is to use an extra objectClass: extensibleObject to allow all defined attributes (e.g. host) to be used within my object. I could also create a new objectClass ( 2.25.$UUID.1.2.1 NAME 'myGroup' DESC 'Group with host attribute' SUP posixGroup AUXILIARY MAY host ) As far as I can tell using extensibleObject has the disadvantage to more or less disable the checks for correct attribute usage. Are there more positive or negative aspects to extensibleObject? I'd like to hear your thought on this. Thanks, Uwe

1 0

Logo usage
by Gloria Semme 21 Mar '24

21 Mar '24

Dear OpenLDAP Technical Team, I am reaching out to seek your guidance and permission regarding the use of the OpenLDAP logo. My team is in the process of creating a Grafana integration designed to facilitate the monitoring of OpenLDAP applications for our users. To enhance user experience and direct attention effectively, we plan to incorporate the OpenLDAP logo within the Grafana Cloud interface. Upon reviewing the available licensing information, we noted the absence of specific guidelines related to the use of the OpenLDAP logo. Given this, we wish to ensure our use aligns with your expectations and policies. Our design considerations include adjusting the logo to fit a square format to suit the dashboard's aesthetic. We are committed to respecting your branding guidelines and are open to any alternative suggestions or requirements you may have. We appreciate your support in this endeavor and look forward to your guidance. Thank you for your guidance. Best regards, -- [image: photo] *Gloria Semme* Sr. Engineering Manager Cloud Infrastructure Observability gloria.semme(a)grafana.com www.grafana.com

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical