openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

Re: Antw: multiples syncrepl from same host and DB
by julien soula 15 Apr '15

15 Apr '15

On Wed, Apr 15, 2015 at 02:40:37PM +0200, Ulrich Windl wrote: > >>> julien soula <jsoula(a)univ-lille2.fr> schrieb am 15.04.2015 um 13:29 in > Nachricht <20150415112905.GB3225(a)nickel.univ-lille2.fr>: > > hello, > > > > I wanted to synchronize 2 branches of a master DB (slapd-2.4.38). So I > > created 2 olcSyncrepl on the slave : > > > > olcSyncrepl: {0}rid=201 provider=ldap://master > > searchbase="cn=branch1,suffixDB" scope=sub > > olcSyncrepl: {1}rid=202 provider=ldap://master > > searchbase="cn=branch2,suffixDB" scope=sub > > > > Unfortunatly, it doesn't work. A change on branch2 on the master > > produces often a "CSN too old" on the slave. > > > > After investigating, it seems that the pb comes from the fact there is > > one contextCSN by DB. So if the sync task on branch1 is the first to > > process, it updates the contextCSN and therefore the sync task on > > branch2 thinks that change is not newer. Am I right ? > > If the message you are talking about is like this: > slapd[3965]: do_syncrep2: rid=001 CSN too old, ignoring 20150409131449.846699Z#000000#001#000000 (olcDatabase={1}hdb,cn=config) yes > _and_ the CSN received is the CSN sent,... yes > ... then just ignore the message. That is the same server said before: > slapd[3965]: slap_queue_csn: queing 0x7f5f30afcf20 20150409131449.846699Z#000000#001#000000 > > > > > So is there a proper way to achieve what I want ? > > Did you check the databases before and after sync? Are there differences, or are you just worried about the messages? In fact, I first noticed the no-change of the slave then I took a look to the log and saw this message (the only suspect I saw). Is this config supposed to work ? sincerly, -- Julien << Vous n'avez rien a dire... Parlons-en! >>

1 1

Re: multiples syncrepl from same host and DB
by Abdelhamid MEDDEB 15 Apr '15

15 Apr '15

Hi, I don't think so. Try instead: olcSyncrepl: {0}rid=201 provider=ldap://master searchbase="suffixDB" filter="(<a filter who return data in both branch1 and 2>)" ... Reset the data in slave before trying again Maybe it would be better Cheers Le 15/04/2015 14:00, openldap-technical-request(a)openldap.org a écrit : hello, I wanted to synchronize 2 branches of a master DB (slapd-2.4.38). So I created 2 olcSyncrepl on the slave : olcSyncrepl: {0}rid=201 provider=ldap://master searchbase="cn=branch1,suffixDB" scope=sub olcSyncrepl: {1}rid=202 provider=ldap://master searchbase="cn=branch2,suffixDB" scope=sub Unfortunatly, it doesn't work. A change on branch2 on the master produces often a "CSN too old" on the slave. After investigating, it seems that the pb comes from the fact there is one contextCSN by DB. So if the sync task on branch1 is the first to process, it updates the contextCSN and therefore the sync task on branch2 thinks that change is not newer. Am I right ? So is there a proper way to achieve what I want ? -- *Abdelhamid MEDDEB* http://www.meddeb.net

1 0

Re: Help: LDAP using alias to reference value of another attribute
by Quanah Gibson-Mount 14 Apr '15

14 Apr '15

--On Tuesday, April 14, 2015 5:52 PM +0400 Poul Etto <zepouletto(a)gmail.com> wrote: > There are "u" user accounts on the ldap server > We have a number of "s" services that use LDAP to manage user account. > Each service has particular attributes > Each service must be able to access only it's information > Basic services use only the information contained in the standard LDAP > useraccount > Advanced services have dedicated OUs with special attributes > > It is important that each service can accees in RO (no modification) to > only it's information. > That's why we made our LDAP as it is in the attached picture. This is what custom objectClasses and ACLs are for. Here's an example of a directory set up correctly: <https://itservices.stanford.edu/service/directory/datadefs/accounts> Where services are tied to the user object, with their own specific attributes. ACLs can be used to restrict what data a given service can retrieve. --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

can't chang ldap user passwd by self
by rockwang 14 Apr '15

14 Apr '15

hi,guys I just setup a openldap server via compile command as following. ./configure --prefix=/opt/openldap --enable-overlays=mod --enalbe-dynamic=yes --enable-modules=yes --enable-ppolicy=yes slapd.conf as below include /opt/openldap/etc/openldap/schema/core.schema include /opt/openldap/etc/openldap/schema/cosine.schema include /opt/openldap/etc/openldap/schema/inetorgperson.schema include /opt/openldap/etc/openldap/schema/nis.schema include /opt/openldap/etc/openldap/schema/openldap.schema include /opt/openldap/etc/openldap/schema/ppolicy.schema pidfile /opt/openldap/var/run/slapd.pid argsfile /opt/openldap/var/run/slapd.args access to attrs=userPassword by self write by anonymous auth by dn.base="cn=Manager,dc=abc,dc=com" by * none access to * by self write by dn.base="cn=Manager,dc=abc,dc=com" by * read by * none database bdb suffix "dc=abc,dc=com" rootdn "cn=Manager,dc=abc,dc=com" rootpw 12345678 directory /opt/openldap/var/openldap-data index cn,sn,uid pres,eq,approx,sub index objectClass eq loglevel -1 my question is user can't change his own password. I use following command so I have different result. when not add -x is there error in my config file about acl. I have set pwdRest is true. I need help. thks

4 6

Where are 'attribute names' in the RFC?
by dE 12 Apr '15

12 Apr '15

I was reading https://tools.ietf.org/html/rfc4512; there is a mention of attribute description, but there is no mention of 'attribute name'; or the name using which attributes are referred to. Does such a thing exist or is one of the attribute options used as the name to refer to it or is it in the attribute description?

1 1

ldap_sasl_interactive_bind_s works while ldap_sasl_bind_s does not (GSSAPI bind)
by Osipov, Michael 10 Apr '15

10 Apr '15

Hi folks, I am trying to perform a SASL bind against Active Directory with GSSAPI mech. I wrote a very simple C client which should serve as a proof of concept. I read the man page about both methods [1] and decided to try ldap_sasl_bind_s first. I saw that ldap_sasl_bind_s never sends a Kerberos token to the server (Wireshark capture). Then I tried ldap_sasl_interactive_bind_s as in ldapsearch after fiddler with interact and defaults, which is by the way not very helpful described in the man page, though [2] helped a lot. This one works flawlessly. The difference between both is not really clear to me because we aren't going to use any interactive code. Our goal is to write attribute retrieval for headless libs. A day after, I have downloaded the source tarball and saw that ldap_sasl_bind_s never calls sasl_client_start where ldap_sasl_interactive_bind_s actually does. Additionally, I have found gssapi.c with ldap_int_gss_spnego_bind_s and ldap_gssapi_bind_s where both init the GSS context and loop over the tokens with ldap_sasl_bind_s. Does that ultimately mean that one should avoid ldap_sasl_bind_s altogether and work with ldap_sasl_interactive_bind_s regardless of the mech(s) used? [1] http://www.openldap.org/software/man.cgi?query=ldap_sasl_bind_s&sektion=3&a… [2] http://adam.younglogic.com/2012/02/exteranl-sasl/ Regards, Michael

1 0

can't chang password via simple authentication
by rockwang 09 Apr '15

09 Apr '15

hi,guys I can't chang user password via simple authentication at ldap client. I have set acl rule in slapd.conf. access to attr=userPassword by self write by anonymous auth by dn.base="cn=Manager,dc=abc,dc=com" write by * none access to * by self write by dn.base"cn=Manager,dc=abc,dc=com" write by * read ldappasswd -x -D "uid=bobliu,ou=it,dc=abc,dc=com" -W -S New password: Re-enter new password: Enter LDAP Password: ldap_bind: Invalid credentials (49) but can use ldapsearch via simple authentication. what about problem. thks

2 1

Re: Very slow ldapserach
by Saša-Stjepan Bakša 09 Apr '15

09 Apr '15

On 9 April 2015 at 17:57, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, April 09, 2015 10:21 AM +0200 Saša-Stjepan Bakša < > ssbaksa(a)gmail.com> wrote: > >> And search for all still crashes openldap server >> >> ldapsearch -h 10.14.252.103 -p 389 -D cn=admin,dc=spr -w siemens -s sub >> -a always -b dc=SPR objectClass=* >> >> >> I must wait for 2.4.41 release then. In the mean time I will use LTB >> project build with HDB to see can I have that version in working state >> for my colleagues test suite. >> > > Hi Sasa, > > Thanks for checking. Looks like there is some more work to do in this > area before 2.4.41 releases. I wil be asking you to do further testing in > the near future. If it were possible for you to provide me an example DB > and your slapd configuration that replicates this behavior, it would help > with a resolution. > > --Quanah Hi Quanah, I will be more than happy to provide help with testing. I am at home now but tomorrow morning (8:00 CET) I will provide as much data as I can to you. As some of data can be of sensitive nature, may be I will be obliged to send it directly to you. Is that Ok with you? Best regards, Sasa

1 0

Re: Very slow ldapserach
by Saša-Stjepan Bakša 09 Apr '15

09 Apr '15

On 9 April 2015 at 17:57, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, April 09, 2015 10:21 AM +0200 Saša-Stjepan Bakša < > ssbaksa(a)gmail.com> wrote: > >> And search for all still crashes openldap server >> >> >> >> I must wait for 2.4.41 release then. In the mean time I will use LTB >> project build with HDB to see can I have that version in working state >> for my colleagues test suite. >> > > Hi Sasa, > > Thanks for checking. Looks like there is some more work to do in this > area before 2.4.41 releases. I wil be asking you to do further testing in > the near future. If it were possible for you to provide me an example DB > and your slapd configuration that replicates this behavior, it would help > with a resolution. > > --Quanah > > And again I did stupid thing to send withoth checking recipient. I hate this Gmail web interface. Sorry.

1 0

Bug with MDB backend and onelevel scope
by Côme BERNIGAUD 09 Apr '15

09 Apr '15

Hello, I got this weird behavior: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=782212 Summary: # LDAPv3 # base <ou=wheezy,ou=debian,ou=fai,ou=configs,ou=systems,dc=mcmic,dc=test> with scope oneLevel # filter: objectClass=FAIbranch # requesting: ALL # # wheezy, debian, fai, configs, systems, mcmic.test dn: ou=wheezy,ou=debian,ou=fai,ou=configs,ou=systems,dc=mcmic,dc=test This dn should not be in the results as it’s the base and the scope is oneLevel. As I managed to build slapd from http://www.openldap.org/software/download/ and reproduce the problem I thought I should ask here if anyone already encountered this kind of problems. It only happens with MDB, with this particular base and filter (filter "ou=wheezy" for instance works correctly). Any idea what the root of this problem could be?

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical