openldap-technical

openldap-technical@openldap.org

9 participants
9902 discussions

OpenLDAP with SASL not working
by Don Fike 04 Jun '15

04 Jun '15

Greetings, I am using OpenLDAP 2.4.39 with SASL 2.1.23 on CentOS 6.6. I have setup this CentOS server with the same configuration as I have on a working RedHat 6.6 server. However with this CentOS server the SASL combination is not working. Using LDAP without SASL with a SSHA password authentication works. When using pass-through SASL I see a err=49 in the slapd output and the client sees Invalid Credentials. I see no output in saslauthd when run in debug when using LDAP. Running testsaslauthd alone works as expected and this does generate output in the saslauthd debug terminal. It appears that saslauthd never gets the request from slapd. Any suggestions on how to debug this further in order to determine why it is not working appreciated. Thanks,

3 4

AW: OLC permissions - general beginner question
by Stefan Bauer 04 Jun '15

04 Jun '15

Hi, why is cn=Manager,dc=example,dc=com not able to access cn=config with the second ACL? According to manpage the asterisk means any so also cn=config. is dn: olcDatabase={1}monitor,cn=config above the rule some kind of limitation or context? # {0}config, config dn: olcDatabase={0}config,cn=config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none # {1}monitor, config dn: olcDatabase={1}monitor,cn=config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,dc=example,dc=com" read by * none Thank you in advance. Stefan

2 1

Log of deleted accounts
by Elias Pereira 04 Jun '15

04 Jun '15

Hi everyone! If no log setting in slapd.conf, I can check in the syslog who deleted a certain user account? -- Elias Pereira

3 2

OLC permissions - general beginner question
by Stefan Bauer 03 Jun '15

03 Jun '15

Dear Users, for research purposes i have installed a RHEL6 system to test the new OLC feature. I only have the cn=config DIT available. The ACLS are: # ldapsearch -Y EXTERNAL -H ldapi:/// -b 'cn=config' '(olcAccess=*)' olcAccess SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: (olcAccess=*) # requesting: olcAccess # # {0}config, config dn: olcDatabase={0}config,cn=config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none # {1}monitor, config dn: olcDatabase={1}monitor,cn=config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=manager,dc=my-domain,dc=com" read by * none so it looks like only UID=0 (root) should be able to interoperate with the directory. However all local users can connect but do not have access to cn=config (this is expected). [user@host ~]$ ldapsearch -Y EXTERNAL -H ldapi:/// -b 'cn=config' SASL/EXTERNAL authentication started SASL username: gidNumber=501+uidNumber=501,cn=peercred,cn=external,cn=auth SASL SSF: 0 # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 So why am i even able to logon and state a query? Regards,

3 3

AW: OLC permissions - general beginner question
by Stefan Bauer 03 Jun '15

03 Jun '15

-----Ursprüngliche Nachricht----- Von: Ferenc Wagner <wferi(a)niif.hu> > You do not "logon", you use external authentication, which means there's > no separate BIND step, like with simple bind (-x) for example. External > authenication is not done by slapd (hence its name; it's done by the > kernel in the above case), thus slapd can't fail it. The only LDAP > operation it sees is a search, and the authenticated DN > (gidNumber=X+uidNumber=Y,...) is not authorized for that, so the result > is "No such object". As ACLs belong to target objects, they are not > suitable for forcing server disconnection as soon as the authenticated > DN is known. Maybe LDAP doesn't even allow such behaviour. Hi, thank you for clarification. Stefan

1 0

Next Release of LMDB
by Vishesh Handa 03 Jun '15

03 Jun '15

Hey guys Is there some kind of rough timeline for when the next version of LMDB will be released? We're using it in KDE and we need the patch for robust mutexes, which is currently in git. I'm not too comfortable in asking all the distributions to have that patch, though opensuse already does that. -- Vishesh Handa

2 2

deleting pwdPolicySubentry attribute
by David Magda 03 Jun '15

03 Jun '15

Hello, "pwdPolicySubentry" is an operational attribute per slapo-ppolicy(5). I was able to add it quite easily, but I can't seem to delete it so an account goes back to using the default policy: $ ldapsearch -H ldap://master -W -D 'cn=admin,dc=example,dc=com' -b 'dc=example,dc=com' '(uid=dmagda)' + Enter LDAP Password: # dmagda, People, example.com dn: uid=dmagda,ou=People,dc=example,dc=com structuralObjectClass: inetOrgPerson entryUUID: 1b0d0b6c-1115-1030-8396-1ba5239e5e7d creatorsName: cn=admin,dc=example,dc=com createTimestamp: 20110512185510Z pwdPolicySubentry: cn=service,ou=pwpolicies,dc=example,dc=com entryCSN: 20150602173051.854144Z#000000#000#000000 modifiersName: cn=admin,dc=example,dc=com modifyTimestamp: 20150602173051Z entryDN: uid=dmagda,ou=People,dc=example,dc=com subschemaSubentry: cn=Subschema hasSubordinates: FALSE $ cat del.ldif dn: uid=dmagda,ou=People,dc=example,dc=com changetype: modify delete: pwdPolicySubentry $ ldapsearch -H ldap://master -W -D 'cn=admin,dc=example,dc=com' -f del.ldif Enter LDAP Password: [...] # search result search: 2 result: 32 No such object Given that I could add the attribute, was thought that it could be deleted as well. Thanks for any info. Regards, David

2 2

Where to find attribute description for dn in core.schema
by Stefan Bauer 02 Jun '15

02 Jun '15

Dear Users, I'm trying to understand the LDIF format and wonder in which schema file the attribute 'dn' is defined? I can only find the long form distinguishedName in core.schema. This is the example I'm using for research: dn: dc=structure-net, dc=de objectclass: organization objectclass: top o: Structure Net l: Hamburg postalcode: 21033 streetaddress: Billwiese 22 Any help is greatly appreciated. Regards, Stefan

3 3

Re: read openldap log file
by Luo, Frank 02 Jun '15

02 Jun '15

Can anybody give me a hint about the lines with a "r" in the end? I see a lot of them now. Thanks! Frank Jun 1 09:40:27 slapd[4049]: daemon: epoll: listen=7 active_threads=0 tvp=zero Jun 1 09:40:27 slapd[4049]: daemon: removing 62 Jun 1 09:40:27 slapd[4049]: daemon: activity on 125 descriptors Jun 1 09:40:27 slapd[4049]: daemon: activity on: Jun 1 09:40:27 slapd[4049]: 115r Jun 1 09:40:27 slapd[4049]: conn=274354 fd=62 closed Jun 1 09:40:27 slapd[4049]: 162r Jun 1 09:40:27 slapd[4049]: 148r Jun 1 09:40:27 slapd[4049]: 196r Jun 1 09:40:27 slapd[4049]: 86r Jun 1 09:40:27 slapd[4049]: 201r Jun 1 09:40:27 slapd[4049]: 241r Jun 1 09:40:27 slapd[4049]: 316r Jun 1 09:40:27 slapd[4049]: 143r Jun 1 09:40:27 slapd[4049]: 320r On Mon, Jun 1, 2015 at 10:12 AM, Luo, Frank <luoy(a)miamioh.edu> wrote: > Can anybody give me a hint about the lines with a "r" in the end? I see a > lot of them now. > > Thanks! > > Frank > > > Jun 1 09:40:27 slapd[4049]: daemon: epoll: listen=7 active_threads=0 > tvp=zero > Jun 1 09:40:27 slapd[4049]: daemon: removing 62 > Jun 1 09:40:27 slapd[4049]: daemon: activity on 125 descriptors > Jun 1 09:40:27 slapd[4049]: daemon: activity on: > Jun 1 09:40:27 slapd[4049]: 115r > Jun 1 09:40:27 slapd[4049]: conn=274354 fd=62 closed > Jun 1 09:40:27 slapd[4049]: 162r > Jun 1 09:40:27 slapd[4049]: 148r > Jun 1 09:40:27 slapd[4049]: 196r > Jun 1 09:40:27 slapd[4049]: 86r > Jun 1 09:40:27 slapd[4049]: 201r > Jun 1 09:40:27 slapd[4049]: 241r > Jun 1 09:40:27 slapd[4049]: 316r > Jun 1 09:40:27 slapd[4049]: 143r > Jun 1 09:40:27 slapd[4049]: 320r > > >

2 1

slapadd 4096-character LDIF line length limitation
by Kartik Subbarao 01 Jun '15

01 Jun '15

I wanted to ask if someone could shed some light on the 4096 character LDIF line length limitation, which seems to have been introduced sometime after 2.4.25. I learned about this the hard way, while trying to slapadd an LDIF file with long jpegPhoto attributes (e.g. 50K+) which loaded just fine on 2.4.25. Now, I get this error: ldif_parse_line: jpegPhoto: invalid base64 encoding char (556b9f15 <= str2entry: str2ad(....) slapadd: could not parse entry (line=14) When I need to preprocess LDIF files before loading them with slapadd, I often remove line continuations in order to simplify pattern matching. So of course from my perspective, it would be great to have the previous behavior back again. But if there are compelling reasons for the current behavior, I'd like to suggest that the code print a better error message that explicitly mentions the line length limit. Regards, -Kartik

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical