openldap-technical

openldap-technical@openldap.org

9 participants
9902 discussions

Migrate from openldap 2.2 to 2.4 issue
by DEVARIEUX Alain 30 Oct '15

30 Oct '15

Hi! First excuse me for my approximative english. I'm trying to migrate from an old Redhat server running openldap 2.2 to a brand new one using Centos 7 and openldap 2.4. Using slapcat / sldapadd I can't have my new server running with an olc config. I'd like to know what I'm doing wrong during this process : # To remove entryUUID lines because they're not usable with openldap 2.4 sed -i -e "/entryUUID/d" /root/myslapcat.ldif # Running slapadd with a 'cleaned' version of my old slapd.conf slapadd -f /tpm/oldserver/slapd.conf -F /etc/openldap/slapd.d/ -c -u -o schema-check=yes -l /root/myslapcat.ldif # moving from file configuration to olc : slaptest -f /tmp/oldserver/slapdb.conf -F /etc/openldap/slapd.d/ # now, I can start the service without problem : systemctl start slapd But, when I try to access the diectory, here is the error messages I have : Oct 29 16:02:57 ldap01-qualif slapd[12351]: conn=1002 fd=11 ACCEPT from IP=10.35.100.87:49238 (IP=0.0.0.0:389) Oct 29 16:02:57 ldap01-qualif slapd[12351]: conn=1002 op=0 BIND dn="cn=Manager,dc=mydomain,dc=fr" method=128 Oct 29 16:02:57 ldap01-qualif slapd[12351]: conn=1002 op=0 BIND dn="cn=Manager,dc=mydomain,dc=fr" mech=SIMPLE ssf=0 Oct 29 16:02:57 ldap01-qualif slapd[12351]: conn=1002 op=0 RESULT tag=97 err=0 text= Oct 29 16:02:57 ldap01-qualif slapd[12351]: conn=1002 op=1 SRCH base="dc=mydomain,dc=fr" scope=1 deref=0 filter="(objectClass=*)" Oct 29 16:02:57 ldap01-qualif slapd[12351]: conn=1002 op=1 SRCH attr=objectclass Oct 29 16:02:57 ldap01-qualif slapd[12351]: bdb(dc=mydomain,dc=fr): BDB0060 PANIC: fatal region error detected; run recovery Oct 29 16:02:57 ldap01-qualif slapd[12351]: bdb(dc=mydomain,dc=fr): BDB0060 PANIC: fatal region error detected; run recovery Oct 29 16:02:57 ldap01-qualif slapd[12351]: bdb(dc=mydomain,dc=fr): BDB0060 PANIC: fatal region error detected; run recovery Oct 29 16:02:57 ldap01-qualif slapd[12351]: bdb(dc=mydomain,dc=fr): BDB0060 PANIC: fatal region error detected; run recovery Oct 29 16:02:57 ldap01-qualif slapd[12351]: conn=1002 op=1 SEARCH RESULT tag=101 err=80 nentries=0 text=internal error But, if a launch slapd like telling it the configuration file to use, everything works well (ie : I can bind to server and view all entries) slapd -u ldap -f /tmp/oldserver/slapd.conf Am I missing something obvious? I'm new to openldap... Regards, -- Alain Devarieux Pôle Infrastructures GIP SIB

3 3

Re: [LMDB] What pointer is returned with combination of MDB_WRITEMAP and MDB_RESERVE?
by Victor Baybekov 30 Oct '15

30 Oct '15

Thanks a lot! My proof-of-concept code works OK. I do not understand all subtle details of mmap reliability, could you please help with these two: If I write data to a pointer to an opaque blob as discussed above, and my process crashes before mdb_env_sync, but OS doesn't crash - will that data be secure in the mmap file? Also, am I correct that mdb_env_sync synchronizes all dirty pages in the mmap file as seen by a file system, regardless how they were modified - either via LMDB API or via a direct pointer writes? As for "you could at least set a callback to notify you that a block has moved" - if that is implemented, it would be nice to have a notification *before* a block is moved (with old and new address, so that right after the callback it is OK to use the new address), otherwise this non-intended but convenient use of LMDB won't work anymore. Best regards, Victor On Sat, Oct 3, 2015 at 1:27 AM, Howard Chu <hyc(a)symas.com> wrote: > Howard Chu wrote: > >> Victor Baybekov wrote: >> >>> Thank you! I understand this copy-on-write behavior, but am interested >>> if I >>> could control it a little. What if I use records that are always much >>> bigger >>> than a single page, e.g. 100 kb with 4kb pages, and make sure that a >>> record is >>> never updated (via LMDB means) during a lifetime of an environment, - is >>> there >>> any scenario that the location of such a big record could be changed >>> during a >>> lifetime of an environment, without updating the record? >>> >> >> At this point in time, no, if you don't update a large record there is no >> reason that it will move. That is not to say that this won't change in the >> future. The documentation tells you what promises we are willing to make. >> Relying on any non-documented behavior is your own responsibility. >> > > Note that the relocation functions in LMDB are intended to accommodate > blocks being moved around. The actual guts of that API haven't been > implemented, but probably in 1.x we'll flesh them out. Given that support, > you could at least set a callback to notify you that a block has moved. But > currently, overflow pages don't move if they're not modified. > > >>> >>> >>> On Fri, Oct 2, 2015 at 4:38 PM, Howard Chu <hyc(a)symas.com >>> <mailto:hyc@symas.com>> wrote: >>> >>> Victor Baybekov wrote: >>> >>> Hi, >>> >>> Docs for MDB_RESERVE say that a returned pointer to the reserved >>> space is >>> valid "before the next update operation or the transaction >>> ends." Docs >>> for MDB_WRITEMAP say that it "writes directly to the mmap >>> instead of >>> using >>> malloc for pages." Does combining the two options return a >>> pointer >>> directly to >>> a place in a mmap >>> >>> >>> Yes. >>> >>> so that this pointer could be used after a transaction ends >>> or after the next update? >>> >>> >>> No. >>> >>> Longer answer: maybe. >>> >>> Full answer: LMDB is copy-on-write. If you update another record on >>> the >>> same page, in a later transaction, the contents of that page will be >>> copied to a new page and the original page will go onto the >>> freelist. In >>> that case, the pointer you got must not be used again. >>> >>> If you don't directly update that page and cause it to be copied, >>> then you >>> might get lucky and be able to use the pointer for a while. It all >>> depends >>> on what other modifications you do and how they affect that node or >>> neighboring nodes. >>> >>> >>> I have a use case where I want to somewhat abuse LMDB safety for >>> convenience. >>> If I could get a pointer to a place inside a mmap I could work >>> with >>> LMDB value >>> as opaque blob or as a region inside the single big mmap. This >>> could >>> be more >>> convenient than creating and opening hundreds of temporary memory >>> mapped files >>> and keeping open handles to them. For example, Aeron terms could >>> be >>> stored >>> like this: a stream id per an LMDB db and a term id for a key in >>> the >>> db. >>> >>> >>> Thanks! >>> Victor >>> >>> >>> >>> -- >>> -- Howard Chu >>> CTO, Symas Corp. http://www.symas.com >>> Director, Highland Sun http://highlandsun.com/hyc/ >>> Chief Architect, OpenLDAP http://www.openldap.org/project/ >>> >>> >>> >> >> > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ >

2 1

Re: (ITS#8290) Our system has occured "Server is unwilling to perform" from slapd when syncrepl rid was changed.
by Andrew Findlay 30 Oct '15

30 Oct '15

On Tue, Oct 27, 2015 at 02:55:11AM +0000, t-ogura(a)az.jp.nec.com wrote: > Subject: (ITS#8290) Our system has occured "Server is unwilling to perform" This does not look like a bug report, so you should direct it to the openldap-technical mailing-list rather than the ITS. > Master server connect two slave nodes , A and B. And, LDAP syncronization > configure as below. > > B server <---> Master server <---> A server > rid=27 rid=30 rid=32 > > Master server is set for LDAP syncronization in slapd.conf. Remember that the syncrepl directive only configures a replication consumer. Servers A and B also need syncrepl directives. All three servers also need the syncprov overlay, and I suspect that this is missing in your case leading to the error that you mentioned. Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

pwdHistory, encrypted passwords and selfservice application
by Bogdan Rudas 30 Oct '15

30 Oct '15

Hello all, I'm working on Self-service application and want to prevent user from re-using old passwords. What is correct way to chage password takin in mind password history? I guess it is: 1. Bind with special user and check if specified uid exists 2. Bind using user-supplied uid and password 3. Get password policy, history etc. and validate on selfservice-side 4. Execute LDAP modifyRequest with single item: userPassword and value of new hashed password. In my case same password gives same hash. Are there any way to force encrypted password history validation on server side? Thank you. -- Bogdan Rudas Head of Minsk IT Support Department Exadel Inc. http://www.exadel.com/ E-mail: brudas(a)exadel.com <mandrushkevich(a)exadel.com> Skype ID: bogdan.rudas -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

4 3

Millions of users linked into a single group
by Alessandro Lasmar Mourão 28 Oct '15

28 Oct '15

Hello, I wonder if there is any limitation on the number of users linked to a group groupOfUniqueNames type? We will provide an application on the Internet for more than 10 million users, and all these users belong (uniqueMember) to a single group. Our support reported that it is recommended that the user group should not have more than 16,000 members, this information accurate? Regards, Alessandro Lasmar Mourão

6 6

syncrepl without cleartext password.
by Prakash Padadune 27 Oct '15

27 Oct '15

I want to implement syncrepl without having cleartext password in the slapd.conf. How this can be achieved? ~~~ *Prakash*

3 2

I don't want to use GSSAPI !?
by Olivier 26 Oct '15

26 Oct '15

Hello everyone, authentication over ldap doesn't work on one of my linux box. Trying to query the ldap server from this machine with ldapsearch, I get this : $ ldapsearch -ZZZ -h ldap1.example:389 -D uid=olivier,dc=example,dc=fr -b dc=example,dc=fr -W Enter LDAP Password: SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (No credentials cache found) Do you know why ldapsearch tries to authenticate using GSSAPI ? I don'use such a mechanism (nor kerberos) and I don't remember that I configured any such a thing. Any idea to desactivate the attempt to use GSSAPI to authenticate ? (note: the ldap client is a linux redhat5) Thanks, --- Olivier

3 8

Exclude ppolicy attributes from accesslog
by Angel L. Mateo 26 Oct '15

26 Oct '15

Hello, I have an openldap server as an authentication backend for my organization. I have a database with my users information. Is this database, I'm using the ppolicy overlay to control my users passwords. I'm also using the acceslog overlay (with its related cn=log database) to keep a log of modifications. With the ppolicy overlay every mistake of a user in an authentication process triggers a modification in the user entry (for the pwdFailureTime attribute) and this modification triggers a new entry the accesslog database. My problem is that this accesslog database is storing a huge amount of this entries and I would like to not store these kind of updates. So my question is if there is any way to exclude some attributes from the accesslog tracking. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

1 0

sets: user and this during bind
by Michael Ströder 25 Oct '15

25 Oct '15

HI! Does "user" or "this" have any meaning during simple bind operation? E.g. when using a back-sock listener the BIND operation contains the bind-DN in 'dn' (let's call it request DN). Is "this" in a set-clause also the bind-DN during the bind operation? Background: I'd like to restrict access to userPassword during processing simple bind operation to peername (IP or path) found in the user's entry (referenced by the bind-DN). Or is there a non-set solution (besides implementing a dynacl module)? Ciao, Michael.

1 0

Q: Requesting parent OU doesn't seem to work right with Meta-Backend OU as child
by Zalewski, Marvyn-Stephano 22 Oct '15

22 Oct '15

Hey guys, I got a huge problem here. I’ve been trying to merge users from a local LDAP (ou=local-users,ou=accounts,dc=domain: which authenticates against a remote active directory (which is not ldap://remote.site) with sasl) with local users who use a local stored password and with users from a remote active directory without storing them locally. Let’s say i have the following structure: Local-LDAP (ldap://localhost): * dc=domain * ou=accounts * ou=local-users (with sasl) * ou=remote-users (Meta-Backend Proxy to ldap://remote.site – ou=accounts,dc=remote-domain) * ou=users (without sasl; password is stored locally) Remote-AD (ldap://remote.site): * dc=remote-domain * ou=accounts * <All Users are stored in this OU> The local LDAP structure works as expected. When i request ou=accounts,dc=domain i get all users located in ou=local-users and ou=users. And now i point out the problem: I only get the object ou=remote-users without the users from ou=accounts,dc=remote-domain so the ou=remote-users seems to be empty. But when i explicit request the full DN of ou=remote-users (ou=remote-user,ou=accounts,dc=domain) i get the full list of all users located in ou=accounts,dc=remote-domain. Here’s my slapd.conf: ####################################################################### # Global Directives: ####################################################################### # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values logfile /etc/ldap/slapd.log loglevel 1 sasl-host localhost sasl-secprops none ####################################################################### # Dynamic Module Directives ####################################################################### # Base Path and individual modules. modulepath /usr/lib/ldap moduleload back_hdb.so moduleload refint.so moduleload memberof.so moduleload back_meta.so moduleload rwm.so # Defining referral integrity module to make sure the group relations are automatically updated. NOTE: Only when a 'delete' or 'edit' command has been issued. overlay refint refint_attributes member uniqueMember seeAlso refint_nothing cn=EMPTY # Defining memberof module which make sure to update the group affiliation for each user. NOTE: Added an own attribute to all users named: 'memberOf' which contains all groups. overlay memberof ####################################################################### # Database Directives: ####################################################################### database meta suffix "ou=remote-users,ou=accounts,dc=domain" readonly off lastmod off uri "ldap://remote.site/ou=remote-users,ou=accounts,dc=domain" suffixmassage "ou=remote-users,ou=accounts,dc=domain“ „ou=accounts,dc=remote-domain" idassert-bind bindmethod=simple binddn=„cn=root,dc=remote-domain" credentials=„root" mode=none flags=non-prescriptive idassert-authzFrom „dn.exact:cn=root,dc=remote-domain" database hdb directory /var/lib/ldap suffix „dc=domain" rootdn "cn=root,dc=domain" rootpw root index objectclass eq index uid eq,sub lastmod off readonly off My Search Results at parent OU: #### ldapsearch -M -a always -D "cn=root,dc=domain" -w root -b "ou=accounts,dc=domain“ dn # extended LDIF # # LDAPv3 # base <ou=accounts,dc=domain> with scope subtree # filter: (objectclass=*) # requesting: dn # with manageDSAit control # # accounts, domain dn: ou=accounts,dc=domain # local-users, accounts, domain dn: ou=local-users,ou=accounts,dc=domain # frank, local-users, accounts, domain dn: cn=frank,ou=local-users,ou=accounts,dc=domain # remote-users, accounts, domain dn: ou=remote-users,ou=accounts,dc=domain # users, accounts, domain dn: ou=users,ou=accounts,dc=domain # peter, users, accounts, domain dn: cn=peter,ou=users,ou=accounts,dc=domain My Search Results at child and proxied OU: #### ldapsearch -M -a always -D "cn=root,dc=domain" -w root -b „ou=remote-accounts,ou=accounts,dc=domain“ dn # extended LDIF # # LDAPv3 # base <ou=remote-users,ou=accounts,dc=domain> with scope subtree # filter: (objectclass=*) # requesting: dn # with manageDSAit control # # remote-users, accounts, domain dn: ou=remote-users,ou=accounts,dc=domain dn: cn=albert,ou=remote-users,ou=accounts,dc=domain I hope you guys can help me out. If you have further question, please leave a mail. Kind regards, Marvyn :)

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical