openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

Fast key range iteration
by Александр Киранов 04 May '15

04 May '15

Hi all! Is there a way to iterate with all key-value pairs in LMDB database, where all keys is in specified range? I'm trying to use mdb_cursor_get() with MDB_SET_RANGE to search first pair. Then I see only one way - use mdb_cursor_get() with MDB_NEXT and compare key by memcmp(). But it seems absolutely not effective. Is there another solution for my task? Thanks!

3 2

Try out our new most advanced medication aimed to conquer you erectile dysfunction!
by Anibal 04 May '15

04 May '15

These simple medicines will bring you back to life in the bedroom Your boner will be back in no time with these low prices We will fill your life with joy! Free tablets this week! http://zzb.bz/34vXj World Anti-ED from FDA

1 0

[LMDB] Two API questions
by Klaus Malorny 04 May '15

04 May '15

Hi, during the implementation of my first project using LMDB I got two questions: 1. I wanted to write a small utility function that determines a rough estimation of the free space, using the mdb_env_stat, mdb_env_info and mdb_stat functions, summing up the block counts, multiplying it with the block size and putting this in relation to the map size. Typically I know which databases exist, but I wondered whether there would be a possibility to enumerate the existing databases and did not find anything. Is it correct that currently there is no way to get the names? 2. For one task, I needed to walk through a subset of the keys with a cursor and to delete key/value pairs that meet some criteria. From the documentation, it is unclear to me how to proceed after a deletion, i.e. which cursor operation should be used to access the next key/value pair. Both MDB_GET_CURRENT and MDB_NEXT seemed to work. Which one is preferred or the "officially" correct way? I guess MDB_NEXT. Thanks a lot. Regards, Klaus

2 1

OpenLDAP referrals and kerberos error for MAC
by Aimee He 03 May '15

03 May '15

Dear Technical of openLDAP, I use OpenLDAP development on the Mac platform, run into the following 2 questions, find a lot of information, still not resolved. Could you help me, Thank you. 1. Referrals error, Code flow: ld = ldap_init(host, port); rc = ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version); rc = ldap_set_option(ld, LDAP_OPT_REFERRALS, LDAP_OPT_ON); rc = ldap_set_rebind_proc(ld, bind_prompt, NULL); rc = ldap_set_option(ld, LDAP_OPT_SIZELIMIT,&sizelimit); rc = ldap_simple_bind_s(ld, adminDN, adminPwd); rc = ldap_search_s(ld, findDN, LDAP_SCOPE_ONELEVEL, [filter UTF8String], attrs, 0, &result); CallBack function： static int bind_prompt(LDAP *ld,LDAP_CONST char *url,ber_tag_t request, ber_int_t msgid, void *params) { static char *dnsuffix; static char dn[256],password[256]; int authmethod; NSLog(@"rebind for request=%ld,msgid=%ld,url=%s\n",request,(long)msgid,url); authmethod = LDAP_AUTH_SIMPLE; NSLog(@"re-bind dn?"); strcat(dn, dnsuffix); if (authmethod == LDAP_AUTH_SIMPLE && dn[0] != '\0') { NSLog(@"re-bind password?"); } else { password[0] = '\0'; } return ldap_bind_s(ld, dn, password, authmethod); } Description of the problem:ldap_search_s() return value is 10, which is LDAP_REFERRAL,an it did not call the function “bind_prompt()”. 2. Kerberos error, Code flow： ld = ldap_init(host, port); rc = ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version); rc = ldap_set_option(ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF); rc = ldap_set_option(ld, LDAP_OPT_SIZELIMIT,&sizelimit); rc = ldap_set_rebind_proc(ld, bind_prompt, NULL); rc = ldap_bind_s(ld, adminDN, adminPwd, LDAP_AUTH_KRBV4); Description of the problem:LDAP_AUTH_KRBV4,LDAP_AUTH_KRBV41,LDAP_AUTH_KRBV42,ldap_bind_s return value is -6, which is LDAP_AUTH_UNKNOWN. Windows Client with the same configuration connected to openLDAP server successfully. Does my code or interface call for errors. Regards! Aimee He Tel:15658 Confidential Information:This message is sent to the intended recipient and may contain privileged or confidential information. If you received this transmission in error, please notify the sender with a replying e-mail and delete the message and any attachment.Transmission Caveat and Virus Alert: Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions.

1 0

idassert-bind seems to ignore binddn
by Ryan Lovett 01 May '15

01 May '15

Hello, I've setup a simple proxy so that local LDAP clients can get access to protected attributes on a remote server. My proxy is slapd 2.4.31 with this slapd.conf: include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel none modulepath /usr/lib/ldap moduleload back_ldap sizelimit 500 tool-threads 1 backend ldap database ldap suffix "dc=company,dc=com" uri ldap://ldap.company.com:389 idassert-bind bindmethod=simple binddn="uid=my_id,ou=my_dept,dc=company,dc=com" credentials="mypass" authcId="dn:uid=my_id,ou=my_dept,dc=company,dc=com" mode=legacy ldap.company.com permits the my_id DN to access privileged attributes that anonymous users cannot. I can run ldapsearch against ldap.company.com with simple auth, binding as my_id, and view the privileged attributes. ldapsearch -H ldap://ldap.company.com:389 -LLL -x \ -b ou=users,dc=company,dc=com \ -W -D uid=my_id,ou=my_dept,dc=company,dc=com \ "(uid=12345)" When I run ldapsearch against my proxy slapd with the above slapd.conf however... ldapsearch -H ldap://myproxy.company.com:389 -LLL -x \ -b ou=users,dc=company,dc=com \ "(uid=12345)" ... a packet trace shows that slapd is connecting to ldap.company.com without binding as my_id: LDAPMessage bindRequest(1) "<ROOT>" simple messageID: 1 protocolOp: bindRequest (0) bindRequest version: 3 name: authentication: simple (0) simple: <MISSING> As a result I do not see the privileged attributes. Based on the docs <http://manpages.ubuntu.com/manpages/trusty/man5/slapd-ldap.5.html>, I've chosen mode=legacy because I'd like for the proxy to "perform a simple bind as the authcDN ... and assert the client's identity when it is not anonymous." I've also tried following the advice at http://www.openldap.org/faq/data/cache/532.html which states: If no authzID is given, and mode is set to none (for instance because the > remote server does not support the proxyAuthz control), the clients will be > authorized as "cn=Proxy,dc=example,dc=com" even if they actually connected > anonymously to the proxy. yielding: idassert-bind bindmethod=simple binddn="uid=my_id,ou=my_dept,dc=company,dc=com" credentials="mypass" mode=none But an ldapsearch of my proxy then reports "Inappropriate authentication (48)" which I don't understand because client-to-proxy and proxy-to-remote all use simple auth. What am I doing wrong? Any advice is greatly appreciated! Ryan

4 7

Significance of name forms.
by dE 30 Apr '15

30 Apr '15

Suppose a name form is attached to a structural object class. Then, when referring to entries belonging to that object class (which has no DIT Structure Rules associated to it), is using the MUST attributes as defined in the name form to construct AVA still necessary? No DIT Structure Rules refer to this name form.

3 15

Re: idassert-bind seems to ignore binddn
by Ryan Lovett 30 Apr '15

30 Apr '15

Thanks for your response. I'm surprised Ubuntu's most recent LTS is shipping such an old version of OpenLDAP! I just built and installed 2.4.40 packages on Ubuntu 14.04 from Debian Jesse's 2.4.40 source. Unfortunately slapd returns the same results as 2.4.31 and a packet capture shows the same binding behavior. Ryan On Thu, Apr 30, 2015 at 6:25 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, April 30, 2015 6:32 PM -0700 Ryan Lovett <rylo(a)berkeley.edu> > wrote: > > >> Hello, >> >> >> I've setup a simple proxy so that local LDAP clients can get access to >> protected attributes on a remote server. My proxy is slapd 2.4.31 with >> >> What am I doing wrong? Any advice is greatly appreciated! >> > > The first thing you're doing wrong is running a version of OpenLDAP that > is so ancient. > > OpenLDAP 2.4.31 Release (2012/04/21) > > I.e., it's over 3 years old. > > There have been multiple fixes to slapd-ldap since that release. This one > in particular may be related: > > OpenLDAP 2.4.33 Release (2012/10/10) > Fixed slapd-ldap idassert bind handling (ITS#7403) > > --Quanah > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

getent passwd only catch local user passwd
by Yingbo Li 30 Apr '15

30 Apr '15

Hi, I am new to LDAP. The company's IT own LDAP server, I tried to configure openldap client but failed. My OS is CentOS 7, openldap is 2.4.39. I configured ldap and ldaps. I can use ldapsearch to find out full ldap info of my LDAP account. I configured with authconfig-tui. I also modified /etc/pam.d/system-auth and password-auth, change pam_sss.so to pam_ldap.so. While when I tried getent passwd, I can only find local users. I cannot su to my LDAP account. Why? I google online it looks like CentOS 7 has problem to configure ldap client. Cent0S 7 does not have pam_ldap module. But I can find pam_ldap.so in the system. What should I do to fix it? Switch to CentOS 6.6? Your help is really appreciated! Thank you! Yingbo

5 10

Ldap challenge
by Ross, Daniel B. 30 Apr '15

30 Apr '15

Ok I have looked a couple options but I really dont know how to accomplish what I need to do. Here is what I am trying to do. I have a greater organization that is stuck on using Microsoft products namely Microsoft LDS. To make matters worse they present the data to my linux servers in a completely non-standard way. Its driving my solaris and linux box nuts and they simply dont want to work with it. What i need to do is continue to use the campus usernames and passwords but present the Data in a format that my linux/unix hosts can use. Is this possible? i.e. userid would still be samwise but instead of a bizzarre OU=monkeypeople,dc=example,dc=com I want it to present as people,dc=example,dc=com. I looked at referral and aliasing but it does not seem to be doing what I am trying to do. Passthrough authentication looks close but I cant find sufficient documentation to actually configure a system to use it. Thanks Daniel

8 12

Re: modifying cn=config with ldapmodify
by Abdelhamid Meddeb 29 Apr '15

29 Apr '15

Hi, In your ssl.ldif file there is a *blank* line too after changetype: modify This is not reported in your first post but it apear in seconde one. I have reproduced the same symptoms with this empty line More details bellow Cheers. Le 29/04/2015 12:56, Robert Munn a écrit : > My replies inline... > > On Apr 26, 2015, at 2:28 AM, Abdelhamid MEDDEB <abdelhamid(a)meddeb.net > <mailto:abdelhamid@meddeb.net>> wrote: > >> Hi, >> >> >> Le 25/04/2015 15:10, Robert Munn a écrit : >>> I have been trying to replace the SSL cert settings on my OpenLDAP >>> instance running on Ubuntu using ldapmodify. >>> >>> >>> I followed directions on the Ubuntu wiki: >>> >>> https://help.ubuntu.com/lts/serverguide/openldap-server.html#openldap-tls >>> >>> using a modified ldif file for the replace: >>> >>> |dn: cn=config >>> changetype: modify >>> replace: olcTLSCACertificateFile >>> olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem >>> - >>> replace: olcTLSCertificateFile >>> olcTLSCertificateFile: /etc/ssl/certs/ldap01_slapd_cert.pem >>> - >>> replace: olcTLSCertificateKeyFile >>> olcTLSCertificateKeyFile: /etc/ssl/private/ldap01_slapd_key.pem| >> |All right| Empty line is not reported here. >>> When it didn’t work on my existing instance I built a new instance >>> in a new Ubuntu VM (14.04) and tried the original directions from >>> Ubuntu. That did not work either. >> May be you've missed some settings at build time like --with-tls > > I installed OpenLDAP using apt. The .deb package must include TLS > because I added the certificates manually. > > >>> >>> The ldapmodify command executes correctly but it seems that the >>> change is not registered by the server. This is the case in both the >>> new instance and the old instance of OpenLDAP. >> No error message like "Insufficient access (50)" ? and you should >> check the write (manage)rights to cn=config database. > > The command I ran (as sudo) and the message: > > ldapmodify -Y EXTERNAL -H ldapi:/// -f ssl.ldif > SASL/EXTERNAL authentication started > SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth > SASL SSF: 0 > modifying entry "cn=config” > > and ssl.ldif : > > dn: cn=config > changetype:modify > > replace: olcTLSCACertificateFile > olcTLSCACertificateFile: /etc/ssl/certs/CAcert > - > replace: olcTLSCertificateFile > olcTLSCertificateFile: /etc/ssl/certs/cert > - > replace: olcTLSCertificateKeyFile > olcTLSCertificateKeyFile: /etc/ssl/private/cert.key > But we show it here, and content changes (strangely) the cn=config.ldif last modified timestamp, but do nothing realy > cn=config.ldif is being modified by the ldapmodify process, I verified > that by changing file permissions on cn=config.ldif, running the > ldapmodify command, and then checking cn=config.ldif. ldapmodify > updated the timestamp and file permissions on the file. The file > changed, but the configuration changes in ssl.ldif were not made in > cn=config.ldif. > > >>> I ended up replacing the values (or adding them in the new instance) >>> in the /etc/ldap/slapd.d/cn=config.ldif file manually. Making the >>> changes manually and restarting slapd works, but my understanding >>> was that changes to cn=config should be made through ldapmodify. >> Bad practice, it's best to avoid. > > Yes, and when I can modify the configuration using ldapmodify, I will > no longer make the changes manually. > > I found a note about enabling logging using ldapmodify: > > https://help.ubuntu.com/lts/serverguide/openldap-server.html > > logging.ldif: > > dn: cn=config > changetype: modify > replace: olcLogLevel > olcLogLevel: stats > > ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f logging.ldif > > I executed this command on my first instance and it added the logging > to cn=config. I executed this command on the second instance, where > olcLogLevel already existed, and it did not alter the log level. > > I have also been experimenting with this script: > > https://github.com/cepharum/slapd-config > > With it, I was able to delete the TLS entries from cn=config: > > slapd-config raw delete cn=config olcTLSCACertificateFile 1 > > but when I tried to add the entries back, I got this error: > > slapd-config raw insert cn=config olcTLSCACertificateFile 1 > "/etc/ssl/certs/cert.pem" > modifying entry "" > ldap_modify: Server is unwilling to perform (53) > additional info: modify upon the root DSE not supported > I have not looked at the details but it seems that there is a bug in this script. (modifying entry "") > > I was able to change the olcLogLevel back to its original state vi > ldapmodify, so maybe there is something particular about the TLS > entries, perhaps having to do with permissions on the certs and keys > themselves? > > I have come across this bug in several forums and have yet to see > someone who solved it in the “correct” manner using ldapmodify. > > > Robert > > > >>> >>> I also found a tech note at CentOS: >>> >>> https://www.centos.org/docs/5/html/CDS/cli/8.0/Configuration_Command_File_R… >>> in section 2.2.2.2 that indicates changes to cn=config will be ignored: >>> >>> "If an attribute is added to |cn=config|, the server ignores it." >>> >>> >>> So am I mistaken? Do I need to do something different? I would >>> prefer to manage the config with ldapmodify, but since I don’t >>> change cn=config that often, I can change it manually. >>> >>> >>> >>> Robert >>> >>> >> >> Cheers, >> -- >> *Abdelhamid MEDDEB* >> http://www.meddeb.net > -- *Abdelhamid Meddeb* http://www.meddeb.net

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical