openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

deleting pwdFailureTime attribute on slave
by David Magda 08 Jun '15

08 Jun '15

Hello, How do I delete the “pwdFailureTime” attribute on a slave? I have a DN where there are a bazillion pwdFailureTime entries and it’s filling up /var/lib/ldap/. I’ve tried the following LDIF: dn: uid=foo,ou=People,dc=example,dc=com changetype: modify delete: pwdFailureTime But since the system is slave, it’s giving ldapmodify(1) a redirect to the master. I’ve tried both the “-M” and “-e manageDSAit” options, and the redirects still occur. This is with 2.4.23 on Debian 6. Thanks for any info. Regards, David

1 0

slapo-accesslog and extended operations
by Michael Ströder 08 Jun '15

08 Jun '15

HI! First of all: For me slapo-accesslog is one of OpenLDAP's killer features. I'm currently wondering about logging of extended operations in particular Password Modify ext. op. I see the resulting auditModify entries but I'd also like to see eventually refused auditExtended entries (e.g. to see the Session Tracking Control sent by the client). Reading access.c it seems that this is currently not supported. Is that right? With a config directive logops writes extended(1.3.6.1.4.1.4203.1.11.1) like described in slapo-accesslog(5) slapd does not even start. Ciao, Michael.

1 0

DIT and ALC: design phase.
by Simone Taliercio 07 Jun '15

07 Jun '15

Hi all, I'm still a newbie about openLDAP, but I need already to get the right choice in this design phase in order to avoid terrible troubles in the next future :) *How would you map the following scenario as for DIT and ACL (olc) ?* We have two companies: *wiki.com <http://wiki.com>* and *grape.jp <http://grape.jp>*. # Data set a) *wiki.com <http://wiki.com>* is the one hosting openLDAP and has several user accounts registered into. b) *grape.jp <http://grape.jp>* can create user accounts in the same openLDAP hosted by *wiki.com <http://wiki.com>* # Authorization c) *wiki.com <http://wiki.com> *can see and manage all the user accounts. d) *grape.jp <http://grape.jp>* can manage only user accounts created by itself. I'm thinking at the following configuration: one database called "dn=wiki,dn=com" which requires objects with following schema dn: mail=user1(a)wiki.com <http://wikitude.com/>,dc=wiki,dc=com objectclass: inetOrgPerson cn: <user1 nickname> givenname: <user1 first name> mail: user1(a)wiki.com <test.fromcmdline(a)wikitude.com> sn: <user1 surname> userPassword: aNiceEncryptedPassword o:<either wiki.com or grape.jp depending on who has created the user> and then setting a proper ACL (olc) on the attribute '*o*' in order to defined who can access what (but on this side I need still to understand A LOT). My configuration is driven from the fact I need also to integrate Liferay 6.1 which needs to see all the user accounts :-( Let me thank you for having read till here! Any suggestion and/or reference would be highly appreciated. Best Regards, Simone P.s. I was looking also for a good guide/book on Amazon, but everything looks quite outdated...

1 0

how do I add olcDbCachesize to my ldap
by Greg Jetter 04 Jun '15

04 Jun '15

Greetings: I'm running openldap 2.4.31 on ubuntu 12.04 , I want to set the cache size for entries to 200,000 I created a ldif : -- leading blank line -- dn: olcDatabase={1},cn=config changetype: modify add: olcDbCachesize olcDbCacheSize: 200000 I get the following : greg@Catbert:~/LDAP3$ sudo ldapadd -Q -Y EXTERNAL -H ldapi:/// -f AddCatchSize.ldif modifying entry "olcDatabase={1},cn=config" ldap_modify: No such object (32) matched DN: cn=config I tried a ldap modify as well : greg@Catbert:~/LDAP3$ sudo ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f AddCatchSize.ldif [sudo] password for greg: modifying entry "olcDatabase={1},cn=config" ldap_modify: No such object (32) matched DN: cn=config The back end is "hdb" , with 140,000 entries ... my olcDatabase ldif is : # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 05be5fce dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=acsalaska,dc=net olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=acsalaska,dc=net" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by self write by dn="cn=admin,dc=acsalaska,dc=net" write by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=acsalaska,dc=net olcRootPW:: ***** removed ********* olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: cdmadauserstatus eq,pres,sub olcDbIndex: cdmadamdn eq,pres,sub olcDbIndex: cdmadamin eq,pres,sub olcDbIndex: cdmaesn eq,pres,sub olcDbIndex: cdmamin eq,pres,sub olcDbIndex: cdmadaTetherAccess eq,pres olcDbIndex: username eq,pres,sub olcDbIndex: cdmameid eq,pres,sub olcDbIndex: cdmadaroamstatus eq,pres,sub olcDbIndex: uid eq,pres,sub structuralObjectClass: olcHdbConfig entryUUID: 1da37b42-815d-1034-96f3-b93aabbbf11e creatorsName: cn=config createTimestamp: 20150427191239Z entryCSN: 20150428201620.191818Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20150428201620Z What am I doing wrong ? all the documentation I have read says olcDbCachesize object should exist ... any thoughts would be greatly appreciated Than you Greg Jetter.

3 6

OpenLDAP with SASL not working
by Don Fike 04 Jun '15

04 Jun '15

Greetings, I am using OpenLDAP 2.4.39 with SASL 2.1.23 on CentOS 6.6. I have setup this CentOS server with the same configuration as I have on a working RedHat 6.6 server. However with this CentOS server the SASL combination is not working. Using LDAP without SASL with a SSHA password authentication works. When using pass-through SASL I see a err=49 in the slapd output and the client sees Invalid Credentials. I see no output in saslauthd when run in debug when using LDAP. Running testsaslauthd alone works as expected and this does generate output in the saslauthd debug terminal. It appears that saslauthd never gets the request from slapd. Any suggestions on how to debug this further in order to determine why it is not working appreciated. Thanks,

3 4

AW: OLC permissions - general beginner question
by Stefan Bauer 04 Jun '15

04 Jun '15

Hi, why is cn=Manager,dc=example,dc=com not able to access cn=config with the second ACL? According to manpage the asterisk means any so also cn=config. is dn: olcDatabase={1}monitor,cn=config above the rule some kind of limitation or context? # {0}config, config dn: olcDatabase={0}config,cn=config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none # {1}monitor, config dn: olcDatabase={1}monitor,cn=config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,dc=example,dc=com" read by * none Thank you in advance. Stefan

2 1

Log of deleted accounts
by Elias Pereira 04 Jun '15

04 Jun '15

Hi everyone! If no log setting in slapd.conf, I can check in the syslog who deleted a certain user account? -- Elias Pereira

3 2

OLC permissions - general beginner question
by Stefan Bauer 03 Jun '15

03 Jun '15

Dear Users, for research purposes i have installed a RHEL6 system to test the new OLC feature. I only have the cn=config DIT available. The ACLS are: # ldapsearch -Y EXTERNAL -H ldapi:/// -b 'cn=config' '(olcAccess=*)' olcAccess SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: (olcAccess=*) # requesting: olcAccess # # {0}config, config dn: olcDatabase={0}config,cn=config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none # {1}monitor, config dn: olcDatabase={1}monitor,cn=config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=manager,dc=my-domain,dc=com" read by * none so it looks like only UID=0 (root) should be able to interoperate with the directory. However all local users can connect but do not have access to cn=config (this is expected). [user@host ~]$ ldapsearch -Y EXTERNAL -H ldapi:/// -b 'cn=config' SASL/EXTERNAL authentication started SASL username: gidNumber=501+uidNumber=501,cn=peercred,cn=external,cn=auth SASL SSF: 0 # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 So why am i even able to logon and state a query? Regards,

3 3

AW: OLC permissions - general beginner question
by Stefan Bauer 03 Jun '15

03 Jun '15

-----Ursprüngliche Nachricht----- Von: Ferenc Wagner <wferi(a)niif.hu> > You do not "logon", you use external authentication, which means there's > no separate BIND step, like with simple bind (-x) for example. External > authenication is not done by slapd (hence its name; it's done by the > kernel in the above case), thus slapd can't fail it. The only LDAP > operation it sees is a search, and the authenticated DN > (gidNumber=X+uidNumber=Y,...) is not authorized for that, so the result > is "No such object". As ACLs belong to target objects, they are not > suitable for forcing server disconnection as soon as the authenticated > DN is known. Maybe LDAP doesn't even allow such behaviour. Hi, thank you for clarification. Stefan

1 0

Next Release of LMDB
by Vishesh Handa 03 Jun '15

03 Jun '15

Hey guys Is there some kind of rough timeline for when the next version of LMDB will be released? We're using it in KDE and we need the patch for robust mutexes, which is currently in git. I'm not too comfortable in asking all the distributions to have that patch, though opensuse already does that. -- Vishesh Handa

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical