openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

multiple password policies and pwdPolicySubentry
by Guruprasad Kulkarni 02 Mar '15

02 Mar '15

Hi, I am running openldap 2.4.40 on Ubuntu 12.04 I need to use N-way multi master replication and there are only 2 masters I am using syncrepl configuration and for the sake of security I didn't want to use the rootdn credentials for replication (I didnt want slapd.conf to have its password in plain text in syncrepl section) So I created a ldapreplicator account on both masters just for replication and only has read privileges I also have a default password policy on the ldap which has requirements that all passwords should expire in 30 days, have lockout duration, etc. The problem is the password policy is also applied to the ldapreplicator account and due to this, the synchronization fails once the password expires. I tried to add a different password policy to ldapreplicator using pwdPolicySubentry but keep getting error 21 invalid syntax. I looked into the documentation and online as well, but I am not sure why I keep getting the invalid syntax error. To keep this post short, I am attaching the slapd.conf, the password policies (default and for replicator), the ldif containing instructions for adding password policy to ldapreplicator and log output I am sure I am missing something, any help would be greatly appreciated -- -Guruprasad

2 3

using cn=config to retrieve DIT records
by Igor Shmukler 02 Mar '15

02 Mar '15

Hello, I have a multi-tenant [multiple DITs] LDAP directory setup. One of things that I need to be able to do, is to retrieve records from individual domain [DIT] -level databases using "superuser" credentials. I am able to do what I need using Unix sockets, as in: $sudo ldapsearch -Y EXTERNAL -H ldapi:/// -b dc=example,dc=com I want to use network credentials and network library to retrieve my information. I am currently able to do this using DIT -level credentials. If I set salt the config password, is there something that would fundamentally prevent the below from working? $ldapsearch -D cn=config -h IPADRRESS -W -b dc=example,dc=com Suggestions? Sincerely, Igor Shmukler

2 3

Re: RE24 testing call (2.4.41)
by devzero2000 02 Mar '15

02 Mar '15

On Wed, Feb 18, 2015 at 1:53 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > If you know how to build OpenLDAP manually, and would like to participate > in testing the next set of code for the 2.4.41 release, please do so. > > Generally, get the code for RE24: > > <http://www.openldap.org/devel/gitweb.cgi?p=openldap. > git;a=snapshot;h=refs/heads/OPENLDAP_REL_ENG_2_4;sf=tgz> > > Configure & build. > > Execute the test suite (via make test) after it is built. > > Thanks! > > Platform : lsb_release -a LSB Version: :core-4.1-amd64:core-4.1-noarch:cxx-4.1-amd64:cxx-4.1-noarch:desktop-4.1-amd64:desktop-4.1-noarch:languages-4.1-amd64:languages-4.1-noarch:printing-4.1-amd64:printing-4.1-noarch Distributor ID: RedHatEnterpriseServer Description: Red Hat Enterprise Linux Server release 7.0 (Maipo) Release: 7.0 Codename: Maipo Test RESULT OK --Quanah > > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > >

1 0

RE24 testing call (2.4.41)
by Quanah Gibson-Mount 02 Mar '15

02 Mar '15

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.41 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

Case Sensitive Binds
by Bram Cymet 27 Feb '15

27 Feb '15

Hi, I am using openldap 2.4.26. My system ignores case when doing binds: Feb 27 16:08:08 devauth slapd[2437]: conn=2723 op=1 BIND dn="uid=Bcymet(a)cbnco.com,ou=test_websales_users,dc=ls,dc=cbn" method=128 Feb 27 16:08:08 devauth slapd[2437]: => bdb_entry_get: found entry: "uid=bcymet(a)cbnco.com,ou=test_websales_users,dc=ls,dc=cbn" So this happily binds with bcymet(a)cbnco.com or Bcymet(a)cbnco.com and returns the same entry. Is this a configuration error on my part? Is it possible to have case sensitive binds and if so what do I have to change? Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. 613-608-9752

3 2

main: TLS init def ctx failed: -1
by jeevan kc 27 Feb '15

27 Feb '15

Hi all,I followed the TLS directives and was able to generate cacert, servercert and server key and also sign it. I also did the configuration o to /usr/local/etc/openldap/slapd.d/cn=config.ldif: § olcTLSCACertificateFile: /usr/local/etc/openldap/cacert.pem § olcTLSCertificateFile: /usr/local/etc/openldap/servercrt.pem § olcTLSCertificateKeyFile: /usr/local/etc/openldap/serverkey.pem Everything was working fine but when I shut down slapd, it doesn't start and gives me this error daemon: IPv6 socket() failed errno=97 (Address family not supported by protocol)Feb 26 15:28:56 lap00551 slapd[14775]: main: TLS init def ctx failed: -1 Can Someone please tell me what the error is and how I fix the issue? Thanks Jeevan

3 4

openldap 2.4.23 password reset sync issue
by Rakesh Rajasekharan 27 Feb '15

27 Feb '15

Hi There, I am using openldap 2.4.23 and trying to set up mirror mode replciation with 2 masters I have been able to set this up and the sync initially appeared to work fine . However, i noticed that the password resets are not getting synced . I am able to login to one of the master server on which I did the change but not on the other and any of the clients. Heres my slapd.conf serverID 1 database bdb suffix "dc=ldap,dc=qa,dc=test,dc=com" checkpoint 1024 15 rootdn "cn=ldapadmin,dc=ldap,dc=qa,dc=test,dc=com" loglevel 256 sizelimit 500 rootpw secret overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=ldap,dc=qa,dc=test,dc=com" ppolicy_use_lockout ppolicy_hash_cleartext directory /mnt1/ldapdata index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN,entryUUID eq syncrepl rid=001 provider="ldaps://ldap1-test" binddn="uid=syncrepl,ou=People,dc=ldap,dc=qa,dc=test,dc=com" bindmethod=simple credentials="secret" searchbase="dc=ldap,dc=qa,dc=test,dc=com" type=refreshAndPersist interval=00:00:00:10 retry="5 10 60 +" timeout=1 schemachecking=off scope=sub tls_cacert=/etc/openldap/sslcerts/Standby.pem mirrormode true overlay syncprov syncprov-checkpoint 50 10 syncprov-sessionlog 100 any inputs on how can i get through this issue. Thanks, Rakesh

3 3

ldapsearch gives partial results
by Emmanuel Dreyfus 26 Feb '15

26 Feb '15

Hello I have a problem with ldapsearch sometimes returning partial results. The result code is still 0 (success), but the list of object is limited to 63 or 127 (it seems there is a 2^n-1 pattern) items instead of expected 136. It will happen after 10 to 15 requests that return the complete result. The filter is below. It can happen even if only DN are requested (no attributes): (&(|(ou=example1)(ou=example2))(objectClass=netExamplePerson) (!(netExampleHidden=TRUE))(netExempleActive=TRUE)) This is OpenLDAP 2.4.40, BDB 4.8.30. All attributes in the filter are indexed, and it happens after the openldap-data directory has been cleared and everything has been reconstructed from scratch. -- Emmanuel Dreyfus manu(a)netbsd.org

4 8

Can't get certificates installed on new server
by Philip Colmer 26 Feb '15

26 Feb '15

I'm getting a generic error 80 when I try to use ldapmodify to configure my LDAP server to use a SSL certificate. Here is the LDIF I'm using: dn: cn=config changetype: modify add: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/certs/gd_bundle-g2-g1.pem - add: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/private/wildcard.linaro.org.key - add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ssl/certs/wildcard.linaro.org.crt and the command: ldapmodify -v -x -H ldapi:/// -f certinfo.ldif -D cn=admin,cn=config -W Running logging at the highest level doesn't seem to give me much to go on ... Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: conn=1001 op=1 do_modify Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: conn=1001 op=1 do_modify: dn (cn=config) Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: >>> dnPrettyNormal: <cn=config> Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: <<< dnPrettyNormal: <cn=config>, <cn=config> Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: conn=1001 op=1 modifications: Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: #011add: olcTLSCACertificateFile Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: #011#011one value, length 34 Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: #011add: olcTLSCertificateFile Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: #011#011one value, length 40 Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: #011add: olcTLSCertificateKeyFile Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: #011#011one value, length 38 Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: conn=1001 op=1 MOD dn="cn=config" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: conn=1001 op=1 MOD attr=olcTLSCACertificateFile olcTLSCertificateFile olcTLSCertificateKeyFile Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: <= acl_access_allowed: granted to database root Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_required entry (cn=config), objectClass "olcGlobal" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "objectClass" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "cn" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcConfigFile" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcConfigDir" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcArgsFile" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcAttributeOptions" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcAuthzPolicy" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcConcurrency" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcConnMaxPending" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcConnMaxPendingAuth" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcGentleHUP" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcIdleTimeout" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcIndexSubstrIfMaxLen" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcIndexSubstrIfMinLen" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcIndexSubstrAnyLen" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcIndexSubstrAnyStep" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcIndexIntLen" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcListenerThreads" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcLocalSSF" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcLogLevel" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcPidFile" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcReadOnly" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcReverseLookup" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcSaslSecProps" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcSockbufMaxIncoming" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcSockbufMaxIncomingAuth" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcThreads" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcTLSVerifyClient" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcTLSProtocolMin" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcToolThreads" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcWriteTimeout" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "structuralObjectClass" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "entryUUID" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "creatorsName" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "createTimestamp" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcTLSCACertificateFile" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcTLSCertificateFile" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcTLSCertificateKeyFile" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "entryCSN" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "modifiersName" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "modifyTimestamp" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: send_ldap_result: conn=1001 op=1 p=3 Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: send_ldap_result: err=80 matched="" text="" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: send_ldap_response: msgid=2 tag=103 err=80 Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: conn=1001 op=1 RESULT tag=103 err=80 text= Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: daemon: activity on 1 descriptor Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: daemon: activity on: Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: 14r I've checked that the user that slapd is running under can read the three files. Any suggestions or clarification on what I've overlooked? Thanks. Regards Philip

4 4

LMDB set range to return less than or equal key
by Victor Baybekov 25 Feb '15

25 Feb '15

Hi! In my use case I have found that MDB_SET_RANGE and MDB_GET_BOTH_RANGE queries are much more useful, in 90+% cases, when they return less than or equal key, not greater or equal. I have tested a quick implementation of "get less or equal", and it is c.50% slower in memory. I must say that if someone told me, before I learned about LMDB, that even with 50% less than original performance such numbers are possible, I would not believe - both are millions ops per seconds in my isolated in-memory microbenchmark. But still, such queries are building blocks of N operations that could require non-linear (N^x, x > 1) number of queries and I am interested if I could easily speed this up closer to the built-in MDB_SET_RANGE. The C code is in this gist <https://gist.github.com/buybackoff/59dabc70fa5ec8351bbe#file-mdb_cursor_get…>. I call it from C# via P/Invoke, the test code is here <https://gist.github.com/buybackoff/59dabc70fa5ec8351bbe#file-c-test-via-pin…>. I made sure that only C methods are different, all other code is the same in C#. But even with the P/Invoke overhead the difference is visible. My naive approach is to use MDB_SET_RANGE as the first step and, if the key from this query is not equal to the requested key, to call MOVE_PREV. Other than an additional call to MOVE_PREV, it requires allocation of a copy of the original key, because MDB_SET_RANGE overwrites it and I haven't found a better way to compare the requested key with the key returned after MDB_SET_RANGE. My experience with C (without # or ++) is 4 days less than 2 month, LMDB was the major reason I started, so my code could be really stupid... If it is not, are there other options? E.g. to recompile LMDB for "less or equal" as default behavior. I have tried to change this code inside `mdb_node_search`: if (rc *>* 0) { /* Found entry is *less than* the key. */ i*++*; /* Skip to get the *smallest entry larger than* key. */ if (!IS_LEAF2(mp)) node = NODEPTR(mp, i); } to this code: if (rc *<* 0) { /* Found entry is greater than the key. */ i*--*; /* Skip to get the *largest entry smaller than* key. */ if (!IS_LEAF2(mp)) node = NODEPTR(mp, i); } but it fails badly. Is "greater or equal" approach deeply rooted in the design of LMDB, or I have missed just a small number of other places and it is feasible to change the behavior globally? If that is possible, I would like to do so and to use my current approach for "greater or equal" instead. I cannot test this quickly on a larger-that-RAM data set (because I struggle with my 128Gb laptop drive). But as far as I understand, in most cases MDB_SET_RANGE will load the page with a previous key in RAM - usually this is the same page or one that has been touched during the search? So in the on-disk scenario the incremental MOVE_PREV will be negligible and I should not worry about that? Is there another, completely different and better, way to perform "less than or equal" query? Thanks! Victor

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical