openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

Re: Help: LDAP using alias to reference value of another attribute
by Quanah Gibson-Mount 14 Apr '15

14 Apr '15

--On Tuesday, April 14, 2015 5:52 PM +0400 Poul Etto <zepouletto(a)gmail.com> wrote: > There are "u" user accounts on the ldap server > We have a number of "s" services that use LDAP to manage user account. > Each service has particular attributes > Each service must be able to access only it's information > Basic services use only the information contained in the standard LDAP > useraccount > Advanced services have dedicated OUs with special attributes > > It is important that each service can accees in RO (no modification) to > only it's information. > That's why we made our LDAP as it is in the attached picture. This is what custom objectClasses and ACLs are for. Here's an example of a directory set up correctly: <https://itservices.stanford.edu/service/directory/datadefs/accounts> Where services are tied to the user object, with their own specific attributes. ACLs can be used to restrict what data a given service can retrieve. --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

can't chang ldap user passwd by self
by rockwang 14 Apr '15

14 Apr '15

hi,guys I just setup a openldap server via compile command as following. ./configure --prefix=/opt/openldap --enable-overlays=mod --enalbe-dynamic=yes --enable-modules=yes --enable-ppolicy=yes slapd.conf as below include /opt/openldap/etc/openldap/schema/core.schema include /opt/openldap/etc/openldap/schema/cosine.schema include /opt/openldap/etc/openldap/schema/inetorgperson.schema include /opt/openldap/etc/openldap/schema/nis.schema include /opt/openldap/etc/openldap/schema/openldap.schema include /opt/openldap/etc/openldap/schema/ppolicy.schema pidfile /opt/openldap/var/run/slapd.pid argsfile /opt/openldap/var/run/slapd.args access to attrs=userPassword by self write by anonymous auth by dn.base="cn=Manager,dc=abc,dc=com" by * none access to * by self write by dn.base="cn=Manager,dc=abc,dc=com" by * read by * none database bdb suffix "dc=abc,dc=com" rootdn "cn=Manager,dc=abc,dc=com" rootpw 12345678 directory /opt/openldap/var/openldap-data index cn,sn,uid pres,eq,approx,sub index objectClass eq loglevel -1 my question is user can't change his own password. I use following command so I have different result. when not add -x is there error in my config file about acl. I have set pwdRest is true. I need help. thks

4 6

Where are 'attribute names' in the RFC?
by dE 12 Apr '15

12 Apr '15

I was reading https://tools.ietf.org/html/rfc4512; there is a mention of attribute description, but there is no mention of 'attribute name'; or the name using which attributes are referred to. Does such a thing exist or is one of the attribute options used as the name to refer to it or is it in the attribute description?

1 1

ldap_sasl_interactive_bind_s works while ldap_sasl_bind_s does not (GSSAPI bind)
by Osipov, Michael 10 Apr '15

10 Apr '15

Hi folks, I am trying to perform a SASL bind against Active Directory with GSSAPI mech. I wrote a very simple C client which should serve as a proof of concept. I read the man page about both methods [1] and decided to try ldap_sasl_bind_s first. I saw that ldap_sasl_bind_s never sends a Kerberos token to the server (Wireshark capture). Then I tried ldap_sasl_interactive_bind_s as in ldapsearch after fiddler with interact and defaults, which is by the way not very helpful described in the man page, though [2] helped a lot. This one works flawlessly. The difference between both is not really clear to me because we aren't going to use any interactive code. Our goal is to write attribute retrieval for headless libs. A day after, I have downloaded the source tarball and saw that ldap_sasl_bind_s never calls sasl_client_start where ldap_sasl_interactive_bind_s actually does. Additionally, I have found gssapi.c with ldap_int_gss_spnego_bind_s and ldap_gssapi_bind_s where both init the GSS context and loop over the tokens with ldap_sasl_bind_s. Does that ultimately mean that one should avoid ldap_sasl_bind_s altogether and work with ldap_sasl_interactive_bind_s regardless of the mech(s) used? [1] http://www.openldap.org/software/man.cgi?query=ldap_sasl_bind_s&sektion=3&a… [2] http://adam.younglogic.com/2012/02/exteranl-sasl/ Regards, Michael

1 0

can't chang password via simple authentication
by rockwang 09 Apr '15

09 Apr '15

hi,guys I can't chang user password via simple authentication at ldap client. I have set acl rule in slapd.conf. access to attr=userPassword by self write by anonymous auth by dn.base="cn=Manager,dc=abc,dc=com" write by * none access to * by self write by dn.base"cn=Manager,dc=abc,dc=com" write by * read ldappasswd -x -D "uid=bobliu,ou=it,dc=abc,dc=com" -W -S New password: Re-enter new password: Enter LDAP Password: ldap_bind: Invalid credentials (49) but can use ldapsearch via simple authentication. what about problem. thks

2 1

Re: Very slow ldapserach
by Saša-Stjepan Bakša 09 Apr '15

09 Apr '15

On 9 April 2015 at 17:57, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, April 09, 2015 10:21 AM +0200 Saša-Stjepan Bakša < > ssbaksa(a)gmail.com> wrote: > >> And search for all still crashes openldap server >> >> ldapsearch -h 10.14.252.103 -p 389 -D cn=admin,dc=spr -w siemens -s sub >> -a always -b dc=SPR objectClass=* >> >> >> I must wait for 2.4.41 release then. In the mean time I will use LTB >> project build with HDB to see can I have that version in working state >> for my colleagues test suite. >> > > Hi Sasa, > > Thanks for checking. Looks like there is some more work to do in this > area before 2.4.41 releases. I wil be asking you to do further testing in > the near future. If it were possible for you to provide me an example DB > and your slapd configuration that replicates this behavior, it would help > with a resolution. > > --Quanah Hi Quanah, I will be more than happy to provide help with testing. I am at home now but tomorrow morning (8:00 CET) I will provide as much data as I can to you. As some of data can be of sensitive nature, may be I will be obliged to send it directly to you. Is that Ok with you? Best regards, Sasa

1 0

Re: Very slow ldapserach
by Saša-Stjepan Bakša 09 Apr '15

09 Apr '15

On 9 April 2015 at 17:57, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, April 09, 2015 10:21 AM +0200 Saša-Stjepan Bakša < > ssbaksa(a)gmail.com> wrote: > >> And search for all still crashes openldap server >> >> >> >> I must wait for 2.4.41 release then. In the mean time I will use LTB >> project build with HDB to see can I have that version in working state >> for my colleagues test suite. >> > > Hi Sasa, > > Thanks for checking. Looks like there is some more work to do in this > area before 2.4.41 releases. I wil be asking you to do further testing in > the near future. If it were possible for you to provide me an example DB > and your slapd configuration that replicates this behavior, it would help > with a resolution. > > --Quanah > > And again I did stupid thing to send withoth checking recipient. I hate this Gmail web interface. Sorry.

1 0

Bug with MDB backend and onelevel scope
by Côme BERNIGAUD 09 Apr '15

09 Apr '15

Hello, I got this weird behavior: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=782212 Summary: # LDAPv3 # base <ou=wheezy,ou=debian,ou=fai,ou=configs,ou=systems,dc=mcmic,dc=test> with scope oneLevel # filter: objectClass=FAIbranch # requesting: ALL # # wheezy, debian, fai, configs, systems, mcmic.test dn: ou=wheezy,ou=debian,ou=fai,ou=configs,ou=systems,dc=mcmic,dc=test This dn should not be in the results as it’s the base and the scope is oneLevel. As I managed to build slapd from http://www.openldap.org/software/download/ and reproduce the problem I thought I should ask here if anyone already encountered this kind of problems. It only happens with MDB, with this particular base and filter (filter "ou=wheezy" for instance works correctly). Any idea what the root of this problem could be?

3 2

Re: Very slow ldapserach
by Saša-Stjepan Bakša 09 Apr '15

09 Apr '15

On 9 April 2015 at 02:37, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, April 08, 2015 8:51 PM +0200 Saša-Stjepan Bakša < > ssbaksa(a)gmail.com> wrote: > > I am sorry for this mistake with answering to you and not to the group. >> It was unintentional mistake. >> >> >> Ok, I will check ITS#7657. >> > > Please try current RE24 code. It is believed the fixes for ITS#8011 which > are scheduled to be part of the 2.4.41 relase should resolve the issue. > > Thanks, > > Quanah > > At 8:00 local time: git checkout OPENLDAP_REL_ENG_2_4 git pull Build + test root@test:~# date; ldapsearch -h 10.14.252.103 -p 389 -D cn=admin,dc=spr -w siemens -s sub -a always -b msisdn=385212000009,dc=MSISDN,dc=SPR objectClass=*; date *Thu Apr 9 08:22:46 CEST 2015* # extended LDIF # # LDAPv3 # base <msisdn=385212000009,dc=MSISDN,dc=SPR> with scope subtree # filter: objectClass=* # requesting: ALL # ----- cut------ # search result search: 2 result: 0 Success # numResponses: 9 # numEntries: 8 *Thu Apr 9 08:23:38 CEST 2015* Nothing changed yet - 52 seconds And search for all still crashes openldap server ldapsearch -h 10.14.252.103 -p 389 -D cn=admin,dc=spr -w siemens -s sub -a always -b dc=SPR objectClass=* 552641e7 >>> dnPrettyNormal: <dc=SPR> 552641e7 <<< dnPrettyNormal: <dc=SPR>, <dc=spr> ber_scanf fmt (m) ber: ber_scanf fmt ({M}}) ber: 552641e7 => mdb_search 552641e7 mdb_dn2entry("dc=spr") 552641e7 => mdb_dn2id("dc=spr") 552641e7 <= mdb_dn2id: got id=0x1 552641e7 => mdb_entry_decode: 552641e7 <= mdb_entry_decode 552641e7 search_candidates: base="dc=spr" (0x00000001) scope=2 552641e7 => mdb_equality_candidates (objectClass) 552641e7 => key_read 552641e7 <= mdb_index_read 10000000 candidates 552641e7 <= mdb_equality_candidates: id=-1, first=16, last=10000015 Segmentation fault I must wait for 2.4.41 release then. In the mean time I will use LTB project build with HDB to see can I have that version in working state for my colleagues test suite. Br Sasa

2 1

LMDB and HP-UX Itanium
by Kristian Amlie 09 Apr '15

09 Apr '15

I'm wondering if the LMDB database has been tested on HP-UX with the Itanium processor? We are trying to use the database there and are seeing strange errors that don't occur on other platforms. Examples are assertions when trying to do cross process access and values not making it into the database correctly. I can provide more details, but I thought I would ask about the current status first. -- Kristian

3 11

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical