openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

Binding through a chaining. It's possible?
by Maximiliano Boscovich 09 Dec '15

09 Dec '15

Hello, I'm having trouble making binding through a chaining. I have 2 servers, server 1 has a referral ou pointing to a another server (server2). Server1 has the following configuration: dn: olcOverlay=chain,olcDatabase={-1}frontend,cn=config objectClass: olcOverlayConfig objectClass: olcChainConfig objectClass: top olcOverlay: chain olcChainCacheURI: FALSE olcChainMaxReferralDepth: 1 olcChainReturnError: TRUE dn: olcDatabase=ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: ldap olcDbURI: "ldap://server2" olcDbStartTLS: none starttls=no olcDbIDAssertBind: mode=self flags=prescriptive,proxy-authz-non-critical bindmethod=simple timeout=0 network-timeout=0 binddn="cn=admin,dc=example,dc=ar" credentials="password" keepalive=0:0:0 olcDbRebindAsUser: FALSE olcDbChaseReferrals: TRUE olcDbTFSupport: no olcDbProxyWhoAmI: FALSE olcDbProtocolVersion: 3 olcDbSingleConn: FALSE olcDbCancel: abandon olcDbUseTemporaryConn: FALSE olcDbConnectionPoolMax: 16 olcDbNoRefs: FALSE olcDbNoUndefFilter: FALSE >From the server1 I can make changes and searches without problems to entries on server2 (the chaining works fine for this), but when I want to make a binding, it gives me invalid credentials. For instance: mboscovich@mambo-tango:~$ ldapwhoami -vvv -h server1 -x -D "uid=useronserver02,ou=users,dc=example,dc=ar" -W ldap_initialize( ldap://server1:389 ) Enter LDAP Password: ldap_bind: Invalid credentials (49) If I make the same query but to the server2 where is hosted the entry (so not the chaining is used) the binding runs smoothly: mboscovich@mambo-tango:~$ ldapwhoami -vvv -h server2 -x -D "uid=useronserver02,ou=users,dc=example,dc=ar" -W ldap_initialize( ldap://server2:389 ) Enter LDAP Password: dn:uid=useronserver02,ou=users,dc=example,dc=ar" Result: Success (0) The logs on server1 when it's fail, show this: Dec 8 19:19:55 server1 slapd[2219]: conn=1014 fd=20 ACCEPT from IP= 10.0.2.2:52358 (IP=0.0.0.0:389) Dec 8 19:19:55 server1 slapd[2219]: conn=1014 op=0 BIND dn="uid=useronserver2,dc=example,dc=ar" method=128 Dec 8 19:19:55 server1 slapd[2219]: conn=1014 op=0 RESULT tag=97 err=49 text= Dec 8 19:19:55 server1 slapd[2219]: conn=1014 op=1 UNBIND Dec 8 19:19:55 server1 slapd[2219]: conn=1014 fd=20 closed and on the server02 i couldn't see any log in this case. What am I doing wrong?. Regards Maximiliano Boscovich

1 0

Samba auth on replicated LDAP: no admin user
by Paul van der Vlis 08 Dec '15

08 Dec '15

Hello, I have a replicated LDAP and a few Windows PC's what want to authenticate using Samba. Normally I use "smbpasswd -w" to give the ldap admin dn, but because it's replicated there is no ldap admin! Is there a way to authenticate using a replicated LDAP? The users are created on the master. I am using the "refreshAndPersist" type of replication. With regards, Paul van der Vlis. -- Paul van der Vlis Linux systeembeheer Groningen https://www.vandervlis.nl/

5 13

Fwd: (ITS#8331) Download mirror list needs updating
by Howard Chu 07 Dec '15

07 Dec '15

A number of the mirror sites have gone offline over the years. Anyone interested in running a new mirror for us? -------- Forwarded Message -------- Subject: (ITS#8331) Download mirror list needs updating Date: Fri, 04 Dec 2015 10:01:12 +0000 From: andrew.findlay(a)skills-1st.co.uk To: openldap-its(a)OpenLDAP.org Full_Name: Andrew Findlay Version: OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (2001:8b0:8d0:f7e1::94) The Netherlands mirror has vanished: ftp.nl.uu.net does not resolve in DNS.

2 1

Growing an LMDB database after MDB_MAP_FULL
by Bruno Freudensprung 07 Dec '15

07 Dec '15

Hi, I have a question regarding growing an LMDB database when a write transaction hits MDB_MAP_FULL. I would like to avoid defining a high mapsize value because my application will contain many MDB_envs, and because I have Windows users (Windows allocates the whole file on the disk). Based on the intuition that MDB_MAP_FULL should not leave the database in a weird state, I have made the following little experiment. When MDB_MAP_FULL is encountered I tried to: * copy the current env (mdb_env_copy) into another directory (fine: it does not seem to contain uncommited data) * reset the transaction < error bit > (modified LMDB code to introduce a < txn->mt_flags &= ~MDB_TXN_ERROR > somewhere) * commit the transaction * close the database * close the env * reopen it with a higher mapsize value * reopen the database * create another transaction * continue writing ... and it seems to be working pretty well. Assuming I am ready to < relax > some of the ACID requirements, does it sound reasonable to think that MDB_MAP_FULL does not leave LMDB is a weird state? And that the < trick > described above should always be working? By < working > I mean: the copied environment will never contain uncommitted data (so I can rely on it to implement a kind of rollback), the reopened environment will always be valid and contain the expected data (data written before hitting MDB_MAP_FULL)? Thanks in advance for any insight, Best regards, Bruno.

2 4

TOTP configuration
by PRAJITH 05 Dec '15

05 Dec '15

Hi, Could you please add more info about the TOTP modul? I could not find any single article about this.

2 1

options to maintain computed attributes?
by Jephte Clain 04 Dec '15

04 Dec '15

hello, I may have a need soon to implement "computed" attributes in LDAP, to accommodate dumb clients that are unable to properly update the database for example, an attribute masterAttr may have values like "A:B" (its value updated by the dumb client), but other clients need the A or B part separately. So whenever masterAttr is updated with value "A:B", firstPartAttr have to be updated with "A" and secondPartAttr with "B" what are my options to achieve this? - is there an overlay like slapo-rwm but for attribute values? I searched but did not found anything. So I guess the answer is no. - using a combination of back-perl, back-relay and slapo-translucent? is that even possible - using back-sock as an overlay to monitor modifications and update the modified objects accordingly? - a script that monitor the accesslog database and update the modified objects accordingly? - biting the bullet and writing an overlay myself? before diving too deep into this issue (and possibly drowning), I figured I would ask. any thoughts? ideas? thanks in advance, best regards, Jephté CLAIN -- *Jephté CLAIN | Développeur, Intégrateur d'applications* Service Systèmes d'Information Direction des Systèmes d'Information <http://dsi.univ-reunion.fr> Tél: +262 262 93 86 31 <tel:+262262938631> || Gsm: +262 692 29 58 24 <tel:+262692295824> www.univ-reunion.fr <http://www.univ-reunion.fr> || Facebook <http://www.facebook.com/pages/Universit%C3%A9-de-La-R%C3%A9union-OFFICIEL/1…> || Twitter <http://twitter.com/univ_reunion>

2 4

RE24 testing call (2.4.43)
by Quanah Gibson-Mount 04 Dec '15

04 Dec '15

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.43 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

5 7

Strange LDAP searches for time, IP address and system users
by MI 03 Dec '15

03 Dec '15

I see very strange searches in my slapd.log, and wonder what I my have misconfigured. On every SSH connection (with ssh key, not password) : Search for the TTY: slapd[3183]: conn=1000 op=307 SRCH base="dc=mydomain,dc=lan" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=pts/2))" slapd[3183]: conn=1000 op=307 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass For the date: slapd[3183]: conn=1000 op=308 SRCH base="dc=mydomain,dc=lan" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=2015-12-03))" The time: slapd[3183]: conn=1000 op=309 SRCH base="dc=mydomain,dc=lan" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=16:28))" The IP: slapd[3183]: conn=1000 op=310 SRCH base="dc=mydomain,dc=lan" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=\28192.168.99.206\29))" (But I don't see "uid=root" when logging in over SSH with a key.) I wouldn't expect to see a search for "root", since it's a system account, and I use a key, so I would expect LDAP to be completely out of the picture. However, I do see many searches in the logs for other system accounts: filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=man))" filter="(&(objectClass=posixAccount)(uid=root))" filter="(&(objectClass=posixAccount)(uid=postfix))" filter="(&(objectClass=posixAccount)(uid=debian-spamd))" filter="(&(objectClass=posixAccount)(uid=amavis))" filter="(&(objectClass=posixAccount)(uid=\2A))" ... Most seem to be triggered by the standard system cron jobs or service restarts etc. The system is Debian 8.2 "Jessie". The following packages related to ldap or pam are installed: ldap-utils 2.4.40+dfsg-1+deb8u1 libaprutil1-ldap:amd64 1.5.4-1 libldap-2.4-2:amd64 2.4.40+dfsg-1+deb8u1 libnss-ldap:amd64 265-3+b1 libpam0g:amd64 1.1.8-3.1 libpam-ldap:amd64 184-8.7+b1 libpam-modules:amd64 1.1.8-3.1 libpam-modules-bin 1.1.8-3.1 libpam-runtime 1.1.8-3.1 nscd 2.19-18+deb8u1 slapd 2.4.40+dfsg-1+deb8u1 At this point, it's difficult for me to know what may be relevant, so I'm afraid I have to paste a lot of stuff here in the hope that it includes some clue for someone... # egrep 'cache|check' /etc/nscd.conf enable-cache passwd yes check-files passwd yes enable-cache group yes check-files group yes enable-cache hosts yes check-files hosts yes enable-cache services yes check-files services yes enable-cache netgroup yes check-files netgroup yes # grep ldap /etc/nsswitch.conf passwd: compat ldap group: compat ldap shadow: compat ldap # listconf /etc/pam_ldap.conf host 127.0.0.1 base dc=mydomain,dc=lan ldap_version 3 rootbinddn cn=admin,dc=mydomain,dc=lan pam_password crypt # listconf /etc/pam.d/common-auth auth [success=2 default=ignore] pam_unix.so nullok_secure auth [success=1 default=ignore] pam_ldap.so use_first_pass auth requisite pam_deny.so auth required pam_permit.so # listconf /etc/pam.d/common-account account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so account [success=1 default=ignore] pam_ldap.so account requisite pam_deny.so account required pam_permit.so # listconf /etc/pam.d/common-password password [success=2 default=ignore] pam_unix.so obscure sha512 password [success=1 user_unknown=ignore default=die] pam_ldap.so use_authtok try_first_pass password requisite pam_deny.so password required pam_permit.so # listconf /etc/pam.d/common-session session [default=1] pam_permit.so session requisite pam_deny.so session required pam_permit.so session required pam_unix.so session optional pam_ldap.so My LDAP olcLogLevel is "filter stats sync". Please let me know if the other lines of that log may be useful, or if other log levels should be enabled (I tried, but didn't notice anything interesting). Well, if you have read so far, now is the time to tell me that this is all useless and that I should have posted that other essential config file which I missed ... :-) Thanks for any help in solving this mystery, MI

1 0

RE: RE24 testing call #3 (2.4.43) LMDB RE0.9 testing call #3 (0.9.17)
by Sergio NNX 02 Dec '15

02 Dec '15

> What git revision of LMDB did you test? The last tag from git repository, 0.9.16 Thanks. > Subject: Re: RE24 testing call #3 (2.4.43) LMDB RE0.9 testing call #3 (0.9.17) > To: sfhacker(a)hotmail.com > From: hyc(a)symas.com > Date: Wed, 25 Nov 2015 13:02:44 +0000 > > Sergio NNX wrote: > > Ciao, > > > > We are testing the latest version of Cyrus SASL against LMDB (on Windows, > > built from source) and when we run the testsuite app, we get a runtime > > exception shown below: > > Please use the -technical mailing list for LMDB discussions. > > > > > ... > > ... > > Testing sasl_listmech()... ok > > Testing serverstart... All memory accounted for! > > ok > > Testing client-first/no-server-last correctly... > > SRP --> start > > > > Program received signal SIGSEGV, Segmentation fault. > > 0x00000000 in ?? () > > (gdb) bt > > #0 0x00000000 in ?? () > > #1 0x00432a4d in mdb_node_search (mc=mc@entry=0x289608, > > key=key@entry=0x289850, exactp=exactp@entry=0x289604) at mdb.c:4943 > > #2 0x004361bc in mdb_cursor_set (mc=mc@entry=0x289608, > > key=key@entry=0x289850, data=data@entry=0x289858, op=op@entry=MDB_SET, > > exactp=exactp@entry=0x289604) at mdb.c:5725 > > #3 0x0043667c in mdb_get (txn=0x35c7b0, dbi=1, key=0x289850, data=0x289858) > > at mdb.c:5391 > > #4 0x00431a55 in _sasldb_getdata () > > #5 0x0042fda3 in sasldb_auxprop_lookup () > > #6 0x004119f7 in _sasl_auxprop_lookup () > > #7 0x00413a6c in _sasl_canon_user_lookup () > > #8 0x0042ea7e in srp_server_mech_step () > > #9 0x0040cddd in sasl_server_step () > > #10 0x0040d361 in sasl_server_start () > > #11 0x0040458f in doauth () > > #12 0x004060d6 in test_clientfirst () > > #13 0x00406405 in foreach_mechanism () > > #14 0x00733d1f in main () > > (gdb) > > > > > > Building SASL against Berkeley DB does not show the same issue. > > > > Any pointers will be greatly appreciated. > > > > Thanks. > > > > Sergio.

2 2

memberOf-overlay and custom schema (slapd.logs attched)
by Dora Paula 02 Dec '15

02 Dec '15

Hi, I want to have some kind of dn-based association between two custom entries (e.g. account<--dn-->device). Therefore I use a combination of the memberOf- and refint overlay (configuration inspired by test057). I use a custom schema: An auxiliary objectClass called "association". It has only one may-attribute called "associate". The custom 'memberOf'-Attribute is called "associationOf", which is a may-attribute of the objectClass "myAccount" (derived from account): OpenLDAP Version: git OPENLDAP_REL_ENG_2_4 #example.com.schema # attributeType ( 1.3.6.1.4.1.9999999.10.1.1 NAME 'associate' DESC 'an associate' SUP distinguishedName ) attributeType ( 1.3.6.1.4.1.9999999.10.1.2 NAME 'associateOf' DESC 'associate of' SUP distinguishedName ) objectClass ( 1.3.6.1.4.1.9999999.10.2.1 NAME 'association' DESC 'association' SUP top AUXILIARY MAY ( associate ) ) objectClass ( 1.3.6.1.4.1.9999999.10.2.2 NAME 'myAccount' DESC 'my account' SUP account STRUCTURAL MAY ( associateOf ) ) #slapd.conf # include /opt/slapd_example.com/etc/openldap/schema/core.schema include /opt/slapd_example.com/etc/openldap/schema/cosine.schema include /opt/slapd_example.com/etc/openldap/schema/ppolicy.schema include /opt/slapd_example.com/etc/example.com.schema pidfile /opt/slapd_example.com/var/run/slapd.pid argsfile /opt/slapd_example.com/var/run/slapd.args loglevel none password-hash {CLEARTEXT} attributeOptions lang- access to dn.base="" by * read access to dn.base="cn=Subschema" by * read database config rootdn "cn=admin,dc=example,dc=com" database mdb suffix "dc=example,dc=com" rootdn "cn=admin,dc=example,dc=com" rootpw "admin" directory /opt/slapd_example.com/var/openldap-data index objectClass,cn,ou,o,dc eq add_content_acl on overlay memberof memberof-group-oc association memberof-member-ad associate memberof-memberof-ad associateOf memberof-dangling ignore memberof-refint FALSE memberof-dn olcOverlay={1}memberof,olcDatabase={2}mdb,cn=config overlay refint refint_attributes associate associateOf refint_nothing olcOverlay={0}refint,olcDatabase={2}mdb,cn=config refint_modifiersname olcOverlay={0}refint,olcDatabase={2}mdb,cn=config #After starting the server, first I add a custom account: # cat << EOF | ldapmodify -x -H "ldap://localhost:2389/" -D "cn=admin,dc=example,dc=com" -w admin dn: uid=myAccount,dc=example,dc=com changetype: add objectClass: top objectClass: myAccount uid: myAccount EOF #Then I add a naked device: # cat << EOF | ldapmodify -x -H "ldap://localhost:2389/" -D "cn=admin,dc=example,dc=com" -w admin dn: cn=device,dc=example,dc=com changetype: add objectClass: top objectClass: device cn: device EOF Now I try to associate them using a single modify operation (adding the aux-objectClass association and the associate attribute). This approach fails, that means: The operation passes without error, but the account's associationOf attribute isn't added. #This modify operation seems to be ignored by memberOf-overlay: # cat << EOF | ldapmodify -x -H "ldap://localhost:2389/" -D "cn=admin,dc=example,dc=com" -w admin dn: cn=device,dc=example,dc=com changetype: modify add: objectClass objectClass: association - add: associate associate: uid=myAccount,dc=example,dc=com - EOF #slapd-log (loglevel -1), see attached all-inclusive-modify.log #Checking the results: # ldapsearch -x -H "ldap://localhost:2389/" -D "cn=admin,dc=example,dc=com" -w admin -b "dc=example,dc=com" -s one '(objectClass=*)' # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope oneLevel # filter: (objectClass=*) # requesting: ALL # # device, example.com dn: cn=device,dc=example,dc=com objectClass: top objectClass: device objectClass: association cn: device associate: uid=myAccount,dc=example,dc=com # myAccount, example.com dn: uid=myAccount,dc=example,dc=com objectClass: top objectClass: myAccount uid: myAccount # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 The second approach (resetting the device and myAccount entry and split the above modify operation into two operations works fine. Details see here: #Splitting the previous modify operation into two works fine: # cat << EOF | ldapmodify -x -H "ldap://localhost:2389/" -D "cn=admin,dc=example,dc=com" -w admin dn: cn=device,dc=example,dc=com changetype: modify add: objectClass objectClass: association EOF cat << EOF | ldapmodify -x -H "ldap://localhost:2389/" -D "cn=admin,dc=example,dc=com" -w admin dn: cn=device,dc=example,dc=com changetype: modify add: associate associate: uid=myAccount,dc=example,dc=com EOF #slapd-log (loglevel -1), see attached split-modify.log #Checking the results: # ldapsearch -x -H "ldap://localhost:2389/" -D "cn=admin,dc=example,dc=com" -w admin -b "dc=example,dc=com" -s one '(objectClass=*)' # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope oneLevel # filter: (objectClass=*) # requesting: ALL # # device, example.com dn: cn=device,dc=example,dc=com objectClass: top objectClass: device objectClass: association cn: device associate: uid=myAccount,dc=example,dc=com # myAccount, example.com dn: uid=myAccount,dc=example,dc=com objectClass: top objectClass: myAccount uid: myAccount associateOf: cn=device,dc=example,dc=com # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 Long story, short question: Is this the intended behaviour? If not is it caused by a misconfiguration or a bug? Thank you very much for your help! Best regards Dora

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical