openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

olcAccess syntax
by Igor Shmukler 18 Mar '15

18 Mar '15

Hello, Sorry. This is repost. I was unable to figure out what is wrong my olcAccess configuration! I am trying to configure my OpenLDAP so that cn=config has full over-the-network write-access with a password.I thought at one point that I got the permissions working. It turns out, those are not working, now. Please say what I am doing wrong. Last time, I had a similar problem with policy. Michael S. saved me a bunch of time by advising to load ppolicy.ldif [with the appropriate schema]. This is obviously no indicator of any kind, yet the problem might be not in the LDIFs or ... I understood that manage is the LDIF version of full permissions. Found olcAccess syntax as "olcAccess: to <what> [ by <who> [<accesslevel>] [<control>] ]+" My OLC directives for ldapmodify(1) are below: dn: olcDatabase={0}config,cn=config changetype: modify replace: olcAccess olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break olcAccess: {1}to * by self write by dn="cn=config" write by * read dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW olcRootPW: {SSHA}HyVltU836iL4aR0P0C6O8eHkOJt8nYGK I tried various combinations, like: olcAccess: {1}to * by dn=cn=config manage by * read The command syntax is valid. Yet my configuration not result in the desired access rights. Instead, when ldapdelete(1) is invoked with -D cn=config on records inside non-config databases, I get: ldap_delete: Insufficient access (50) additional info: no write access to parent Please advise. I thank everyone on the openldap-technical who has been reading my messages. People on this list have been extremely helpful. Sorry to continue being a nag. Sincerely, Igor Shmukler

1 0

openldap MMR "read_config: no serverID / URL match found"
by Divya Vikraman 18 Mar '15

18 Mar '15

Hi, I am using openldap 2.4.39 version and trying to set up multi master replication. This is my configuration ServerID 1 "ldap://ldap1-test.com" ServerID 2 "ldap://ldap2-test.com" overlay syncprov syncprov-checkpoint 10 1 syncprov-sessionlog 100 syncrepl rid=1 provider="ldap://ldap1-test.com" binddn="uid=replication,ou=People,dc=ldap,dc=nqa,dc=test,dc=com" bindmethod=simple credentials="xyzabc" searchbase="dc=ldap,dc=nqa,dc=test,dc=com" type=refreshAndPersist interval=00:00:00:10 retry="5 10 60 +" timeout=1 schemachecking=off scope=sub syncrepl rid=2 provider="ldap://ldap2-test.com" binddn="uid=replication,ou=People,dc=ldap,dc=nqa,dc=test,dc=com" bindmethod=simple credentials="xyzabc" searchbase="dc=ldap,dc=nqa,dc=test,dc=com" type=refreshAndPersist interval=00:00:00:10 retry="5 10 60 +" timeout=1 schemachecking=off scope=sub MirrorMode on I have put the below entries in /etc/default/slap on server 1 SLAPD_SERVICES="ldapi:// ldap://ldap1-test.com" and server 2 SLAPD_SERVICES="ldapi:// ldap://ldap2-test.com" After this I am not able to start the service and when I do a slapd -d sync , I get the error "read_config: no serverID / URL match found" I have seen a similar issue posted in an earlier thread but could not find a solution. Thanks, Divya

3 3

nssov not working after upgrading nss-pam-ldapd
by btb＠bitrate.net 18 Mar '15

18 Mar '15

i use the nss and pam stub libraries from nss-pam-ldapd [no nslcd] with nssov. i've just upgraded nss-pam-ldapd from 0.8.13 to 0.9.4. at the moment, i'm using openldap version 2.4.31. after upgrading nss-pam-ldapd, nss and pam stopped working with ldap, and i see this in slapd's debug log: 54acaf72 daemon: activity on 1 descriptor 54acaf72 daemon: activity on:54acaf72 13r54acaf72 54acaf72 daemon: read active on 13 54acaf72 daemon: epoll: listen=7 active_threads=0 tvp=NULL 54acaf72 daemon: epoll: listen=8 active_threads=0 tvp=NULL 54acaf72 connection_get(13) 54acaf72 connection_get(13): got connid=0 54acaf72 daemon: activity on 1 descriptor 54acaf72 daemon: activity on:54acaf72 54acaf72 daemon: epoll: listen=7 active_threads=0 tvp=NULL 54acaf72 daemon: epoll: listen=8 active_threads=0 tvp=NULL 54acaf72 nssov: connection from uid=0 gid=0 54acaf72 nssov: wrong nslcd version id (33554432) how can i find out what nslcd version id is required, and what version is present in each of the components? thanks -ben

3 5

Update custom schema
by Gremaud Cyrill 17 Mar '15

17 Mar '15

Hello everybody. I have an openldap 2.4+ and I added a custom schema. In my ldap I have a lot of entries which use this schema. I just want to know how can add fields (update) to this schema ? My first idea is to create a new ldif file containing the new schema description, stopping the server, removing the old schema and replace it by the new one and then try to restart the server but I don't know if there is a better way to do this. Thanks you very much for your help. Cyrill Gremaud

2 2

LMDB sequential read from a ">>RAM" database caffe use case
by Brian 16 Mar '15

16 Mar '15

Hi, all I am a caffe user. In my use case, I am reading from a ~300GB lmdb sequentially, reading one element and never accessing again until I read every other element in the db and loops around again. It seems that lmdb will page cache every element. This becomes a problem as the dataset is read in fairly fast and it takes 1 hour before nearly 60% of the RAM is devoted to my lmdb page caches. Then it runs out of unmapped memory to use, so it starts kicking out the page frames of processes of other users, many of which have not been accessed in the last hour. So the system will prefer to kick out those page frames instead of page frames mapped at the beginning of the run. This behavior is entirely understandable but it causes extremely severe thrashing and unresponsive system, as those page frames of other user's comes into use very soon. Does my diagnosis of the situation seem reasonable? As many of our caffe use case is a similar sequential read of a dataset much greater than available RAM, many other caffe users besides me reports a similar issue. They all report their system becoming unresponsive, presumably due to the same thrashing. "training is freezing for multiple hours" https://github.com/BVLC/caffe/issues/1412 "Caffe memory increases with time(iterations?)" https://github.com/BVLC/caffe/issues/1377 "Random freezes" https://github.com/BVLC/caffe/issues/1807 Is there some option that I missed that can inform lmdb that for a certain read-only transaction is going to be purely sequential, so it shouldn't bother to cache the already read elements? If not, is there a plan to include such a feature? Or is there an option I can limit the maximum memory a single lmdb transaction is going to use to cache? Or is there some other possible solution to this problem? ----- I have been using a hack based on this fork https://github.com/raingo/lmdb-fork/commit/091ff5e8be35c2f2336e37c0db4c392f… to avoid this issue. However, I would love to know if there is any less hacky way to solve this problem. ----- I have seen this thread http://www.openldap.org/lists/openldap-devel/201502/msg00052.html but it looks like it is for multiple readers. ----- Any advice on this will be much appreciated!

2 1

Question about ldap_search_ext_s and memory leak
by Jean-Marc Choulet 16 Mar '15

16 Mar '15

Hello, I have a little with this very simple program : #include <iostream> #include <stdlib.h> #define LDAP_DEPRECATED 1 #include <ldap.h> using namespace std; const char* server = "ldap://ldap.xxxx.fr"; const char* cacert_file = "cacert.pem"; const char* root_dn = "cn=replicator,ou=DSA,dc=xxxx,dc=fr"; const char* root_pw = "xxxx"; const char* aliased_people_dn ="ou=AliasedPeople,dc=xxxx,dc=fr"; int main(int argc, char *argv[]) { if (argc != 3) { cerr << "Usage: " << argv[0] << " username password" << endl; return 1; } LDAP *ld; int version = LDAP_VERSION3; int rc; if ((rc = ldap_initialize(&ld, server)) != LDAP_SUCCESS) { cerr << "ldap_initialize: " << server << endl; return EXIT_FAILURE; } if ((rc = ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version)) != LDAP_OPT_SUCCESS) { cerr << "ldap_set_option error: " << ldap_err2string(rc) << endl; return EXIT_FAILURE; } if ((rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE, cacert_file)) != LDAP_OPT_SUCCESS ) { cerr << "ldap_set_option error: " << ldap_err2string(rc) << endl; return EXIT_FAILURE; } if ((rc = ldap_start_tls_s(ld, NULL, NULL)) != LDAP_SUCCESS) { cerr << "ldap_start_tls_s error: " << ldap_err2string(rc) << endl; return EXIT_FAILURE; } if ((rc = ldap_bind_s(ld, root_dn, root_pw, LDAP_AUTH_SIMPLE)) != LDAP_SUCCESS) { cerr << "ldap_bind_s: " << ldap_err2string(rc) << endl; return EXIT_FAILURE; } cout << "user replicator authenticated :)." << endl; LDAPMessage *pResult; struct berval cred; char *pDN; std::string filter("uid=" + string(argv[1])); rc = ldap_search_ext_s(ld, aliased_people_dn, LDAP_SCOPE_SUBTREE, filter.c_str(), NULL, 0, NULL, NULL, NULL, LDAP_NO_LIMIT, &pResult); if (rc != LDAP_SUCCESS) { cerr << "ldap_search_ext_s error: " << ldap_err2string(rc) << endl; ldap_unbind_s(ld); return EXIT_FAILURE; } struct berval **vals; LDAPMessage *pEntry; string user_dn; if (ldap_count_entries(ld, pResult) == 1) { pEntry = ldap_first_entry(ld, pResult); pDN = ldap_get_dn(ld, pEntry); vals = ldap_get_values_len(ld, pEntry, "aliasedObjectName"); if (vals) { user_dn = vals[0]->bv_val; ldap_value_free_len(vals); } ldap_memfree(pDN); } else { cout << "aliasedObjectName attribute not found" << endl; ldap_unbind_s(ld); return EXIT_FAILURE; } ldap_memfree(pResult); if ((rc = ldap_bind_s(ld, user_dn.c_str(), argv[2], LDAP_AUTH_SIMPLE)) != LDAP_SUCCESS) { cerr << "user " << argv[1] << " not authenticated" << endl; ldap_unbind_s(ld); return EXIT_FAILURE; } cout << "user " << argv[1] << " (" << user_dn << ") authenticated" << endl; ldap_unbind_s(ld); return EXIT_SUCCESS; } My program works fine but, if I use valgrind, I have memory leaks : valgrind --leak-check=full ./ldapauth.exe toto secret ==13616== Memcheck, a memory error detector ==13616== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al. ==13616== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright info ==13616== Command: ./ldapauth.exe toto secret ==13616== user replicator authenticated :). user toto (uid=toto,ou=People,ou=17,dc=xxxx,dc=fr) authenticated ==13616== Warning: invalid file descriptor -1 in syscall write() ==13616== ==13616== HEAP SUMMARY: ==13616== in use at exit: 260,453 bytes in 1,157 blocks ==13616== total heap usage: 13,835 allocs, 12,678 frees, 2,138,249 bytes allocated ==13616== ==13616== 149 (56 direct, 93 indirect) bytes in 1 blocks are definitely lost in loss record 65 of 84 ==13616== at 0x4C2CC70: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==13616== by 0x596E604: ber_memcalloc_x (in /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2.8.3) ==13616== by 0x4E48687: ldap_result (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4E4ACA6: ldap_pvt_search_s (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4E4AD4F: ldap_search_ext_s (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4016D4: main (ldapauth.cpp:72) ==13616== ==13616== 271 (80 direct, 191 indirect) bytes in 1 blocks are definitely lost in loss record 69 of 84 ==13616== at 0x4C2CC70: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==13616== by 0x596E604: ber_memcalloc_x (in /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2.8.3) ==13616== by 0x596D031: ber_alloc_t (in /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2.8.3) ==13616== by 0x4E5AA22: ldap_alloc_ber_with_options (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4E48BB7: ldap_result (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4E4ACA6: ldap_pvt_search_s (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4E4AD4F: ldap_search_ext_s (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4016D4: main (ldapauth.cpp:72) ==13616== ==13616== LEAK SUMMARY: ==13616== definitely lost: 136 bytes in 2 blocks ==13616== indirectly lost: 284 bytes in 3 blocks ==13616== possibly lost: 0 bytes in 0 blocks ==13616== still reachable: 260,033 bytes in 1,152 blocks ==13616== suppressed: 0 bytes in 0 blocks ==13616== Reachable blocks (those to which a pointer was found) are not shown. ==13616== To see them, rerun with: --leak-check=full --show-leak-kinds=all ==13616== ==13616== For counts of detected and suppressed errors, rerun with: -v ==13616== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0) I don't understand why. Do you have a idea ? I work on Ubuntu 14.04. The OpenLDAP version is 2.4.31. Thanks, Jean-Marc.

2 2

How to use ldapsearch -Esync ?
by Thomas Cort 16 Mar '15

16 Mar '15

Hi, I'm writing a script that acts on changes in LDAP. I want it to watch the stream of changes, and if the script gets restarted, pick up where it left off. I'm hoping to just be able to pipe ldapsearch -Esync into an LDIF parser -- instead of using the C API. I can get all of the changes with the -Esync=ro option and stream the changes with -Esync=rp, but I can't seem to find the magic combination to pick up where it left off. I tried the command mentioned in the "Replication from OpenLDAP to Fedora 389 DS" thread[1], but no matter what cookie I use (the final control value either as a base64 string or decoded) I can't seem to get it to pick up where it left off. Is my understanding wrong or am I missing something? This is how I understand/expect it to work: ldapsearch ... -Esync=ro # get everything, plus a cookie at the end. # feed the cookie to the next command ldapsearch ... -Esync=ro/cookie # get everything since the last search Any help would be greatly appreciated. Thanks, Thomas [1] http://www.openldap.org/lists/openldap-technical/201402/msg00327.html

1 0

external authentication source
by Dieter Klünter 16 Mar '15

16 Mar '15

Hi, rfc-4422 describes an EXTERNAL mechanism. Is there any means of defining and configuring an external authentication and authorization source, like an external sasl server? Or is this just confined to the client to provide an appropriate authorization string? -Dieter -- Dieter Klünter | Systemberatung http://sys4.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

3 3

openldap mirror mode replication does the versions of client matter
by Rakesh Rajasekharan 14 Mar '15

14 Mar '15

Hi, I have set up mirror mode replication with both my masters running 2.4.39 version. I have around 1000 clients connecting. The versions of openldap on these clients varies from 2.3.43( thats really old I know) , 2.4.23 and few have 2.4.39. My problem is the ldap servers almost hangs or freezes when the clients start connecting. In the error logs , I see this pattern " conn=6005 fd=4199 closed (TLS negotiation failure " Is this something to do with the client versions and will upgrading help. I was skeptical as this is in production. One more question, In mirror mode is it ok to have more than 2 masters. Thanks, Rakesh

2 1

Is CA issued certificate using OpenSSL as good as GoDaddy
by jeevan kc 12 Mar '15

12 Mar '15

I followed the below OpenLDAP guide to create CA issued certificate using OpenSSL and was able to enable SSL in the ldap server and applications can connect via ldaps:// port 636. Now I have some questions from the management where this certificate is as safe as the commercial certificates out there. Can someone clarify this? I would appreciate it. I followed the same procedures mentioned in the guide. 4.2 CA Issued CertificateIf you have access to a trusted Certificate Authority (CA), then step through the CA process to get a CA certificate, server certificate and server private key. See section 5.0 for info on how to configure your server with these items.However, if a trusted CA is not available, OpenSSL makes the same process quick and easy.The steps: 1. Create any directory for creating and signing your certificates. For example, /var/myca.% mkdir /var/myca2. Change to /var/myca and run the OpenSSL CA script (in /usr/share/ssl/misc/ on my box):% cd /var/myca/ % /usr/share/ssl/misc/CA.sh -newca CA certificate filename (or enter to create) <enter> Making CA certificate ... Using configuration from /etc/ssl/openssl.cnf Generating a 1024 bit RSA private key ..........................++++++ .........................++++++ writing new private key to './demoCA/private/./cakey.pem' Enter PEM pass phrase: <ca pass> Verifying password - Enter PEM pass phrase: <ca pass again> ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:US State or Province Name (full name) [Some-State]:Texas Locality Name (eg, city) []:Austin Organization Name (eg, company) [Internet Widgits Pty Ltd]:Example Org Organizational Unit Name (eg, section) []:Example Unit Common Name (eg, YOUR name) []:example.com Email Address []:. %This creates demoCA/cacert.pem and demoCA/private/cakey.pem (CA cert and private key).3. Make your server certificate signing request (CSR):% openssl req -newkey rsa:1024 -nodes -keyout newreq.pem -out newreq.pem Using configuration from /etc/ssl/openssl.cnf Generating a 1024 bit RSA private key ..............++++++ ..........................++++++ writing new private key to 'newreq.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:US State or Province Name (full name) [Some-State]:Texas Locality Name (eg, city) []:Austin Organization Name (eg, company) [Internet Widgits Pty Ltd]:Example Org Organizational Unit Name (eg, section) []:Example Org Unit Common Name (eg, YOUR name) []:myserver.com Email Address []:ldap@myserver.com Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: <pass> An optional company name []:. %The result is newreq.pem.4. Have the CA sign the CSR:% /usr/share/ssl/misc/CA.sh -sign Using configuration from /etc/ssl/openssl.cnf Enter PEM pass phrase: <ca pass> Check that the request matches the signature Signature ok The Subjects Distinguished Name is as follows countryName :PRINTABLE:'US' stateOrProvinceName :PRINTABLE:'Texas' localityName :PRINTABLE:'Austin' organizationName :PRINTABLE:'Example Org' organizationalUnitName:PRINTABLE:'Example Org Unit' commonName :PRINTABLE:'myserver.com' emailAddress :IA5STRING:'ldap(a)myserver.com' Certificate is to be certified until Apr 10 18:58:58 2004 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: md5WithRSAEncryption Issuer: C=US, ST=Texas, L=Austin, O=Example Org, OU=Example Unit, CN=example.com Validity Not Before: Apr 11 18:58:58 2003 GMT Not After : Apr 10 18:58:58 2004 GMT Subject: C=US, ST=Texas, L=Austin, O=Example Org, OU=Example Org Unit, CN=myserver.com/Email=ldap@myserver.com Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): < ... > Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: D0:C0:9D:46:30:65:2A:9C:63:63:6A:E6:FE:E4:AC:F7:21:F8:33:61 X509v3 Authority Key Identifier: keyid:31:2E:0D:FB:A0:74:5A:0B:4B:C5:C4:E0:69:7F:32:6D:AF:46:82:F1 DirName:/C=US/ST=Texas/L=Austin/O=Example Org/OU=Example Unit/CN=example.com serial:00 Signature Algorithm: md5WithRSAEncryption < ... > -----BEGIN CERTIFICATE----- < ... > -----END CERTIFICATE----- Signed certificate is in newcert.pem %This creates newcert.pem (server certificate signed by CA) with private key, newreq.pem.5. Now the certificates can be moved to the desired certificate repository and renamed. I prefer /usr/var/openldap-data as my certificate directory.% cp demoCA/cacert.pem /usr/var/openldap-data/cacert.pem % mv newcert.pem /usr/var/openldap-data/servercrt.pem % mv newreq.pem /usr/var/openldap-data/serverkey.pem % chmod 400 /usr/var/openldap-data/serverkey.pem

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical