openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

SSL CA Certificate issue ../../CA/newcerts: No such file or directory
by jeevan kc 24 Feb '15

24 Feb '15

Hi all I'm having trouble with the generation of CA. Please see the error at the bottom and I'd appreciate any help to fix the issue. [root@lap00551]# mkdir /var/myca/[root@lap00551]cd/var/myca[root@lap00551 myca]# /usr/local/openssl.1.0.0d/misc/CA.sh -newcaCA certificate filename (or enter to create) Making CA certificate ...Generating a 1024 bit RSA private key.............++++++........................++++++writing new private key to './demoCA/private/./cakey.pem'Enter PEM pass phrase:Verifying - Enter PEM pass phrase:-----You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [GB]:USState or Province Name (full name) [Berkshire]:****Locality Name (eg, city) [Newbury]:****Organization Name (eg, company) [My Company Ltd]:****Organizational Unit Name (eg, section) []:DISCommon Name (eg, your name or your server's hostname) []:lap00551.****Email Address []:**** Please enter the following 'extra' attributesto be sent with your certificate requestA challenge password []:****An optional company name []:****Using configuration from /etc/pki/tls/openssl.cnfEnter pass phrase for ./demoCA/private/./cakey.pem:I am unable to access the ../../CA/newcerts directory../../CA/newcerts: No such file or directory Regards,Jeevan

2 2

SSL CA Certificate issue ../../CA/newcerts: No such file or directory
by jeevan kc 24 Feb '15

24 Feb '15

1 0

create new user with same UID and GID
by Fabián M Sales 24 Feb '15

24 Feb '15

I am creating users in LDAP and I assign different UID and GUI. For example. uid = _16661_ (user1) gid = _16664_ (user1) groups = _16664_ (user1) I need that when the user is created is created with the same UID and GID for user created. as I do this? I would love for it to be so: uid = _16664_ (user1) gid = _16664_ (user1) groups = _16664_ (user1) Thanks in advance -- Firma Institucional *Fabián* *M. Sales *Soporte Técnico & I.T.I Linux *DonWeb * La Actitud Es Todo www.DonWeb.com ------------------------------------------------------------------------ Nota de confidencialidad: Este mensaje y archivos adjuntos al mismo son confidenciales, de uso exclusivo para el destinatario del mismo. La divulgación y/o uso del mismo sin autorización por parte de DonWeb.com queda prohibida. DonWeb.com no se hace responsable del mensaje por la falsificación y/o alteración del mismo. De no ser Ud el destinatario del mismo y lo ha recibido por error, por favor, notifique al remitente y elim?elo de su sistema. Confidentiality Note: This message and any attachments (the message) are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited by DonWeb.com. DonWeb.com shall not be liable for the message if altered or falsified. If you are not the intended addressee of this message, please cancel it immediately and inform the sender Nota de Confidencialidade: Esta mensagem e seus eventuais anexos podem conter dados confidenciais ou privilegiados. Se você os recebeu por engano ou não é um dos destinatários aos quais ela foi endereçada, por favor destrua-a e a todos os seus eventuais anexos ou copias realizadas, imediatamente. É proibida a retenção, distribuição, divulgação ou utilização de quaisquer informações aqui contidas. Por favor, informenos sobre o recebimento indevido desta mensagem, retornando-a para o autor.

7 8

root dn password: which one is the reference?
by Jephte Clain 23 Feb '15

23 Feb '15

hello, I have an ldap server with rootdn cn=admin,dc=domain,dc=tld and password set in cn=config (this is openldap 2.4.40 on debian squeeze) I have also the ldap objet cn=admin,dc=domain,dc=tld in the database, with a *different* password both password seem to authenticate. is this expected? This used NOT to work (I don't remember but I think it was on an old version using slapd.conf). I have always considered the password defined in cn=config to be the last resort password, in case the database is corrupted. but when the database is active, I expect the password in the database to be the reference. Being able to regularly change the root dn password looks like a good thing to me. Obviously I'm wrong :-) Out of curiosity, when did this change, if ever? TIA. with best regards, -- Jephté Clain Direction des Systèmes d'Information et des Usages Numériques - 2IG Tél. 0262 93 86 31 Fax. 0262 93 81 06

2 2

cross DIT/TLD rootdn - or allow a foreign rootdn
by lejeczek 22 Feb '15

22 Feb '15

hi everybody I'm just looking at the surface and still have lots to read/lean, but I thought this one should be easy to achieve/set up. Having multiple top level domains I wanted to allow rootdn from other domain (say B) to have similar access rights to rootdn of home domain (say A) and i put this into config of A domain to * by dn="cn=manger,dc=B,dc=topdom" manage but I get infamous: Insufficient access (50) additional info: no write access to parent Is possible what I try to do, does LDAP allow, i prepared for such a scenario? If yes can I get some light shed on what I got wrong or did not get at all. many thanks.

2 2

porting an old bdb wrapper to lmdb - any tips/docs?
by Paul DeBruicker 22 Feb '15

22 Feb '15

Hi - I'm going to port a Smalltalk BerkeleyDB wrapper that was created in 2002 to LMDB. Are there any docs that might help me get my bearings? I've found the ones in the LMDB source code/doxygen site. Thanks Paul

1 0

replica from a to b
by Desfosses, Francois 20 Feb '15

20 Feb '15

Hello World! First of all, I'm not very familiar with LDAP slapd.d config style, well neither with slapd.conf! (I took those server from the old sysadmin, so I'm still in the learning process.) I've been banging my head on the walls for the past 2 days with this, and I can't make it work. I have a server, up and running, and working. (Inside amazon aws) I cloned that server, and started it, working just fine. Then I went on this; https://documentation.fusiondirectory.org/en/documentation/replication_syncr epl Executed that stuff on the first/primary/provider, as mentioned on that page. I'm not even sure it's working but, LDAP is still working as well as sssd. So nothing seems broken. (using Centos 6.6 x86_64) I went on the cloned/secondary/consumer and executed that part mentioned above. But I can't make the LDIF working, I'm getting errors. As I am looking at my /etc/openldap/slapd.d/cn=config/ folder, I see that I have all the files EXCEPT the olcDatabase={1}bdb.ldif, this leads me to think that there is no DB, and therefore, I cannot create or use the creation portion of the replica. Now I am confused. What should be my next step? Create from scratch a new openldap empty DB? Or just duplicate via RSYNC the primary info including the /var/lib/ldap folder ? Or, maybe that site I was looking up brought me in the wrong direction and there might be a better place that explain how to set up a replica with the slapd.d configuration style ? Best regards Francois D.

4 4

LMDB: comparison contexts, lifetimes, composite keys
by Lauri Alanko 19 Feb '15

19 Feb '15

Hello. I have some non-OpenLDAP-related LMDB questions and suggestions. I hope this is the correct list for them. If not, please point to a better venue. It seems that MDB_cmp_func is a plain binary function without a context parameter. This makes it impossible to tune a comparison operation at runtime (without libffi magic, anyway). In particular, it makes it difficult to create bindings for the set_compare operation in other languages. Funnily enough MDB_rel_func _does_ have a context pointer, even though it is not used yet. So would it be feasible to add a similarly contextful version of the comparison function? (Arguably these two could share the context pointer, it could just be mdb_dbi_set_userctx.) Although the documentation in lmdb.h is generally good, it's a bit wishy-washy when it comes to lifetimes of data. The mdb_get documentation only says: "The memory pointed to by the returned values is owned by the database". My understanding is that the pointers to the key/data pair retrieved from the database are valid for the duration of the current transaction. After the transaction is over, the page in which the key/data pair was located may be reclaimed for other uses. If this is correct, could it be reflected in the documentation a bit more explicitly? The current behavior is a bit inconsistent, though, in that depending on the operation, mdb_cursor_get may or may not update the `key` argument to point to the key in the database. It would be much clearer if after the call it _always_ pointed to the key in the database, even for operations (like MDB_SET_KEY) where the value of the key would be the same as the input argument. Finally, what is the recommended way of dealing with composite keys? Suppose I want to look up a value associated to a pair of keys (say, a directory id and a filename). There are several ways of doing this: * Encode the pair (key1, key2) into a single key, use that normally. * Use MDB_DUPSORT, encode each (key2, value) as data for a duplicate key key1. Make sure the encoding is such that the data are sorted by key2. Then use MDB_GET_BOTH_RANGE to look up the nearest entry for a given (key1, key2) pair and check it actually has the correct key2. * Create a named database for each key1, store its name as the data for key1. Store normal (key2, value) pairs in the named database, Each of these has its problems. The first is somewhat wasteful, especially if, say, key1 is long and often repeated. The second is what I use, but it feels a bit kludgy: I'm supposed to use a key-value store yet I still have to manually decode and encode key-value pairs to and from their constituents. The third has lots of overhead if there are very few entries for a given key1, and it requires us to manually manage the lifetimes of the named databases. My understanding is that MDB_DUPSORT internally does something close to the third option (but with optimizations to avoid wasting pages for just a few entries), but just using empty data items in the key-specific subdatabase. Would it then be feasible to add direct support for composite keys by allowing non-empty data there? Thanks, Lauri Alanko la(a)iki.fi

2 2

2.4.40 RPMs for openSUSE
by Michael Ströder 17 Feb '15

17 Feb '15

HI! After some struggle and help by some opensuse-packaging list members (thanks!) I achieved almost what I wanted. I'd appreciate if someone could work on SLES support. Build status and files: https://build.opensuse.org/package/show/home:stroeder:branches:network:ldap… If you're using the openldap packages shipped with openSUSE make sure to read the .changes files to see whether something could break your current setup. Up to now I've tested openSUSE 13.2 and Factory on x86_64 and Factory_ARM on rasperry pi. Note: openSUSE 12.3 was announced to be EOL so I've disabled the repo in my home project. I can easily re-enable it if needed (or branch my repo in your own home project). The usual disclaimer: Don't play with it in production! The download repos are here: http://download.opensuse.org/repositories/home:/stroeder:/branches:/network… Make yourself familiar with zypper commands. Example: Add the repo in openSUSE 13.1 (command in one line): zypper addrepo --refresh http://download.opensuse.org/repositories/home:/stroeder:/branches:/network… Please test. Your feedback is appreciated. Especially have a look at whether the RPMs behave well regarding config files, package descriptions etc. There's a new package openldap2-contrib with a selection of overlays from, you might have guessed, the contrib/ source directory. slapo-noopsrch is still missing because of http://www.openldap.org/its/index.cgi?findid=7998 Since web2ldap makes heavy use of noop search control I'd be glad if someone could look into ITS#7998. ;-) Ciao, Michael.

1 2

[SOLVED] Re: Inconsistent answer from LDAP Server
by Yoann Gini 16 Feb '15

16 Feb '15

Hello, Just for information, I’ve found the mechanism in OpenLDAP allowing integrators to do stupid things: overlays. Apple has created a customer overlay for their own services and has recently added hardcoded value for specific request with specific attributes. http://www.opensource.apple.com/source/OpenLDAP/OpenLDAP-499.27/OpenLDAP/se… I didn’t know that overlay was able to have deep control like that over LDAP request. I can’t thanks you for this end since no one has ever mentioned that OpenLDAP has official hooking API on LDAP request but here is the solution for my problem and now I know how to fix it by my own, without waiting for a fix from Apple, just patching slapd, changing a condition in odusers_search function. Best regards, Yoann

5 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical