openldap-technical

openldap-technical@openldap.org

9 participants
9902 discussions

Overlay for applying business logic filters to LDAP modifies/deletes
by Bannister, Mark 26 Jun '15

26 Jun '15

Hi, I'm setting up a new OpenLDAP infrastructure on Solaris, where the directory will be critical and we need to keep a tight control on the changes made to it. The changes will come from an external feed, and as an extra safety measure to protect against software bugs that could otherwise cripple our infrastructure, we would like to put an overlay into the directory server that will make sure that the changes being made to the directory do not break some basic business rules we are defining. The rules will be along these lines: - Do not allow more than 10% of entries underneath a given DIT to be modified in less than a 24 hour period - Entries underneath a given DIT must have a specified list of object classes and attributes defined - Do not permit modrdn under a given DIT - Attribute values match a particular defined set of REs (I can do this with the constraint overlay) - Some critical entries cannot be modified or removed (I can do this with access control lists) - Some attributes not used in the DN must be unique (I can do this with the unique overlay) So I'm ok with the last three, but any suggestions for the first three? Has anyone else implemented similar overlays already? Thanks & regards, Mark Bannister. ________________________________ NOTICE: Morgan Stanley is not acting as a municipal advisor and the opinions or views contained herein are not intended to be, and do not constitute, advice within the meaning of Section 975 of the Dodd-Frank Wall Street Reform and Consumer Protection Act. If you have received this communication in error, please destroy all electronic and paper copies; do not disclose, use or act upon the information; and notify the sender immediately. Mistransmission is not intended to waive confidentiality or privilege. Morgan Stanley reserves the right, to the extent permitted under applicable law, to monitor electronic communications. This message is subject to terms available at the following link: http://www.morganstanley.com/disclaimers If you cannot access these links, please notify us by reply message and we will send the contents to you. By messaging with Morgan Stanley you consent to the foregoing.

2 1

Waiting for initial replication to complete
by Bannister, Mark 26 Jun '15

26 Jun '15

Hi, When I first set-up a new OpenLDAP consumer (syncrepl) it can take 5-10 minutes to sync the data from the master server. The script I've written that configures the replica needs to know when the initial full replication is complete. At the moment I'm testing to see if all the top-level containers are in place, and then waiting a little longer, but this seems pretty fragile to me. Is there a more accurate way of determining once the initial syncrepl is complete? Thanks, Mark. ________________________________ NOTICE: Morgan Stanley is not acting as a municipal advisor and the opinions or views contained herein are not intended to be, and do not constitute, advice within the meaning of Section 975 of the Dodd-Frank Wall Street Reform and Consumer Protection Act. If you have received this communication in error, please destroy all electronic and paper copies; do not disclose, use or act upon the information; and notify the sender immediately. Mistransmission is not intended to waive confidentiality or privilege. Morgan Stanley reserves the right, to the extent permitted under applicable law, to monitor electronic communications. This message is subject to terms available at the following link: http://www.morganstanley.com/disclaimers If you cannot access these links, please notify us by reply message and we will send the contents to you. By messaging with Morgan Stanley you consent to the foregoing.

2 1

Remove bdb log files automatically
by PRATIK SINGAL 24 Jun '15

24 Jun '15

Hello Can any one suggest me the configuration to remove the old log files automatically . And also if we will need to set a checkpoint variable in slapd.conf

3 3

Replacement for ldap_sort_entries
by Côme BERNIGAUD 24 Jun '15

24 Jun '15

Hello, I’m trying to get rid of the -DLDAP_DEPRECATED=1 option when building the php-ldap module. For other functions it went fine but the php function ldap_sort is using ldap_sort_entries which is deprecated with no replacement. As I can’t remove ldap_sort from PHP API, I need to find a way to replace this function call if I want to get rid of deprecated calls. I tried copy/pasting the function code to see if I could built it myself but then it complains about incomplete type for LDAPMessage, which seems internal to libldap. Any idea about a replacement for this function? Côme

3 4

mulitple URI for failed TLS connection
by Daniel Jung 22 Jun '15

22 Jun '15

Hi, Using openldap-2.4.39. Just want to confirm that its normal behaviour for ldapsearch(CLI) to fail on the first attempt and not to use the next server in URI setting? I can see the SSSD handles TLS failure better by querying the next server in the URI. Cheers,

1 0

group email addresses
by Brendan Kearney 22 Jun '15

22 Jun '15

i have done some reading, and it seems that no official standard exists for group email addresses. to that end, i am looking to enlighten myself about what is done to provide mail addresses for groupOfNames groups. i would imagine there is some overlap between what many or most folks do and that would be a good starting point for me. i figure its something like "you have 7 steps to perform, and everyone does step 1,2,3 and 5 the same way. the rest, you are on your own for." i want to setup mailboxes for these groups, for example: cn=ldapAdmins,ou=domainGroups,ou=Groups,dc=bpk2,dc=com cn=ldapEngineers,ou=domainGroups,ou=Groups,dc=bpk2,dc=com these are groupOfNames structural groups, with top and posixGroup classes as aux. where do most folks begin, when setting up group mailboxes? i found a schema that is not official and has been extended with the same names but different numerical OIDs. I am not sure if this is the right path to follow, or if something more "standards focused" is appropriate. any help is appreciated. thanks, brendan

5 7

LDAPCon 2015 submission deadline approaching
by Andrew Findlay 19 Jun '15

19 Jun '15

LDAPCon 2015 will be held in Edinburgh on 11-13 November. The submission deadline for paper and tutorial proposals is 28th June so you have just one week to send us your ideas: http://ldapcon.org/2015/?page_id=5 Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

best attr for multiple fields in one TAB-separated field ..
by lejeczek 18 Jun '15

18 Jun '15

.. which would be mail related, can somebody recommend? many thanks. P.

1 0

does slapd store/cache TLS certs
by lejeczek 18 Jun '15

18 Jun '15

hi everybody, I could not connect to slapd, command would fail with infamous: TLS: error: connect - force handshake failure: errno 0 - moznss error -5938 TLS: can't connect: TLS error -5938:Encountered end of file. ldap_err2string ldap_start_tls: Connect error (-11) additional info: TLS error -5938:Encountered end of file I was positive about certs, restarted daemons, looked at other obvious places, etc. - nothing. Only after I removed database & config files, recreated/restarted the whole slap it worded. Would it be that slapd caches certificates somewhere and does not re-read those upon restart? many thanks

2 2

open ldap meta backend empty search
by Pierluca Marino 17 Jun '15

17 Jun '15

Hi, I have a problem with meta backend feature. I need to get data from two different LDAP under a unique dn. The two ldap are an active directory and another ldap that should be on the same Open LDAP instance of the meta backend. Actually to test the solution I'm usind Open LDAP Windows version. This is my sladp config: # LDIF Backend configuration file # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. ucdata-path ./ucdata include ./schema/core.schema include ./schema/cosine.schema include ./schema/nis.schema include ./schema/inetorgperson.schema include ./schema/openldap.schema include ./schema/dyngroup.schema pidfile ./run/slapd.pid argsfile ./run/slapd.args # Enable TLS if port is defined for ldaps TLSVerifyClient never TLSCipherSuite HIGH:MEDIUM:-SSLv2 TLSCertificateFile ./secure/certs/server.pem TLSCertificateKeyFile ./secure/certs/server.pem TLSCACertificateFile ./secure/certs/server.pem ####META database meta suffix "dc=proxy,dc=company,dc=it" rootdn "cn=Manager,dc=proxy,dc=company,dc=it" rootpw "secret" uri "ldap://adhost:390/dc=proxy,dc=company,dc=it" suffixmassage "dc=proxy,dc=company,dc=it" "dc=company,dc=cosmag,dc=it" lastmod off idassert-bind bindmethod=simple binddn="cn=Manager,dc=company,dc=cosmag,dc=it" credentials="password" mode=none flags=non-prescriptive idassert-authzFrom "dn.exact:cn=Manager,dc=proxy,dc=company,dc=it" acl-authcDN "cn=Manager,dc=company,dc=cosmag,dc=it" acl-passwd "password" uri "ldap://localhost:389/dc=proxy,dc=company,dc=it" suffixmassage "dc=proxy,dc=company,dc=it" "dc=portal,dc=company,dc=it" lastmod off idassert-bind bindmethod=simple binddn="cn=Manager,dc=portal,dc=company,dc=it" credentials="secret" mode=none flags=non-prescriptive idassert-authzFrom "dn.exact:cn=Manager,dc=proxy,dc=company,dc=it" acl-authcDN "cn=Manager,dc=portal,dc=company,dc=it" acl-passwd "secret" ####################################################################### # ldif database definitions ####################################################################### database ldif directory ./ldifdata suffix "dc=portal,dc=company,dc=it" rootdn "cn=Manager,dc=portal,dc=company,dc=it" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw {SSHA}Bww72HPj9nrNxrLAQxuTqP1Z0zuafPPd The server start normally, but when I do a search starting from base dn "dc=proxy,dc=company,dc=it" nothing is returned: ldapsearch -H ldap://localhost:389 -x -D "cn=Manager,dc=proxy,dc=company,dc=it" -W -b "dc=proxy,dc=company,dc=it" -s base -a always -z 1 "(objectClass=*)" "hasSubordinates" "objectClass" # baseObject : dc=proxy,dc=company,dc=it # scope : baseObject (0) # derefAliases : derefAlways (3) # sizeLimit : 1 # timeLimit : 0 # typesOnly : False # filter : (objectClass=*) # attributes : hasSubordinates objectClass #!SEARCH RESULT DONE (32) OK #!CONNECTION ldap://localhost:389 #!DATE 2015-06-16T07:38:21.970 # numEntries : 0 Server log returns: conn=1000 op=6 <<< meta_back_search_start[1]=0 conn=1000 op=6 meta_back_search: ncandidates=0 cnd="**" conn=1000 op=6 meta_back_search: base="dc=proxy,dc=company,dc=it" scope=0: no candidate could be selected send_ldap_result: conn=1000 op=6 p=3 send_ldap_response: msgid=7 tag=101 err=52 Where is my mistake? There is something that I have missed in configuration? Best Regards Pierluca

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical