openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

slapacl Read:Allow - ldapsearch no result
by Uli Tehrani 26 Jan '15

26 Jan '15

Hello all, i want to allow general read access for attribute sshPublicKey. I configured the following rule on top access to attrs=sshPublicKey by * read slapacl -f /etc/openldap/slapd.conf -vvv -b uid=utehrani,ou=ActiveUser,ou=PosixUser,ou=User,dc=example,dc=com sshPublicKey/read read access to sshPublicKey: ALLOWED But when i run ldapsearch. I get no such object ldapsearch -LLL -h ldap1 -x -b uid=utehrani,ou=ActiveUser,ou=PosixUser,ou=User,dc=example,dc=com sshPublicKey No such object (32) Who can helps ? I am running openldap 2.4.39-8 Thanks in advance Regards Uli Uli -- =================================== Ulrich Tehrani Am Ulrichshof 19 79189 Bad Krozingen +497633806246 u_tehrani(a)yahoo.de ===================================

3 2

OpenLDAP Replication Issue
by Tony S. Wu 26 Jan '15

26 Jan '15

We have 5 servers running OpenLDAP, 001 - 005. Server is CentOS 6.4, LDAP version is openldap-servers-2.4.23-32.el6_4.1.x86_64, current replication topology is: 001 <=> 002 001 <=> 003 001 <=> 004 001 <=> 005 001 is where the phpLDAPAdmin GUI is running on. 002 - 005 are behind a load balancer, 001 is never directly accessed from clients. I understand this makes 001 the single point of failure in terms of replication, but we would like to fix the current issues before exploring more changes. The issue we are running is intermittent failure in replication. Replication is configured as multi-way master with mirror mode, it always works from 001 to the rest, but sometimes fails the other direction. This is particularly bad when user changes password and it doesn't get replicated to back to 001, and when that happens it doesn't get replicated to the rest of the other servers. In the log we see the following error messages sometimes, but when replication fails sometimes there is no log: Error Log: Jan 21 10:56:42 001 slapd[27161]: do_syncrepl: rid=004 rc -2 retrying (4 retries left) Another issue is failure on slapd service. On each of the server we have a cronjob running that basically dumps the database using slapcat once an hour. However once every 2 weeks or so we would find slapd dead right around the same time slapcat was run. There is no obvious error in ldap log, system log, or dmesg. According to the documentation it is safe to run slapcat while slapd is running, is this not true? Below is the replication section of the configuration on 001 and 004. If someone could advise on this it would be very much appreciated. moduleload syncprov.la serverid 1 cachesize 50000 idlcachesize 50000 syncrepl rid=002 provider=ldap://002.server.com binddn="uid=replication,ou=Services,dc=server,dc=com" bindmethod=simple credentials=******** searchbase="dc=server,dc=com" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes tls_reqcert=never * repeat for 003, 004, and 005 * mirrormode true overlay syncprov syncprov-checkpoint 1000 60 syncprov-sessionlog 100 index entryCSN,entryUUID eq

7 9

Re: OpenLDAP Replication Issue
by Marc Patermann 26 Jan '15

26 Jan '15

Tony, Tony S. Wu schrieb (23.01.2015 20:19 Uhr): please keep replies on the list. > We kinda did this out of necessity. This is hell of an answer! :) > Out ultimate goal is to remove > 001, move web UI to 002, and move the replication hub role to 002. > > The reason we haven't done so is because of replication issue. We > would like to at least figure out what's wrong before introducing > additional changes. You may consider moving to a 4 node MMR cluster. Or make 001 and 002 a MMR cluster, which work as provider for your 003 to 005 as read-only replicas, which sent referrals to the provider cluster or use chaining. (You may use a service address for the cluster and move phpLDAPAdmin GUI to the cluster as well.) Maybe these are more commonly used setups than your current one. Marc

1 0

LDAP ldapsearch filter: return uidNumber if person has sub ou=mail
by Leander Schäfer 25 Jan '15

25 Jan '15

I'm trying to construct a ldap filter for my Dovecot/Postfix setup which acts as the example pseudo code & result below: |return uidNumber OF objectClass=posixAccount IF they have a ou=mail AND the mailAddress in this ou=mail IS EQUAL to test(a)Mydomain.TLD || # User-1, people, Mydomain.TLD dn: uid=||User-1,ou=people,dc=MyDomain,dc=TLD uidNumber: 2110 | More specific like this while %s holds e.g.: test(a)Mydomain.TLD: |search_base = dc=Mydomain,dc=TLD query_filter = ( &(objectClass=posixAccount)(ou=mail)(mailAddress=%s) ) result_attribute = uidNumber | But obviously uidNumber is being hold by the posixAccount container one level above - and therewith it won't display what I want. Unfortunately I couldn't figure out how to get it work. My LDAP structure looks like this: => dc=MyDomain,dc=TLD ==> ou=People ===> uid=User-1 ====> uidNumber=4035 ====> ou=mail =====> mailAddress=test(a)Mydomain.TLD ===> uid=User-2 Any help would be greatly apprecitated Thanks Best Regards Leander

4 16

I am new to ldap and i dont know much about ldap simple authentication could you plz help me and give some suggestions......and below is the simple code which i tried and ther is also uid test 1&2 which i want to authenticate
by Bharath K 23 Jan '15

23 Jan '15

import java.util.Hashtable; import javax.naming.Context; import javax.naming.InitialContext; import javax.naming. NamingEnumeration; import javax.naming.NamingException; public class SimpleBindDemo { public static void main(String[] args) throws NamingException { if (args.length < 2) { System.err.println("Usage: java SimpleBindDemo <userDN> <password>"); System.exit(1); } Hashtable env = new Hashtable(); env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory"); env.put(Context.PROVIDER_URL, "ldap://localhost:389/"); env.put(Context.SECURITY_AUTHENTICATION, "simple"); //env.put(Context.SECURITY_PRINCIPAL,"cn=Manager, ou=People,dc=example,dc=com"); //env.put(Context.SECURITY_CREDENTIALS,"ldap123"); env.put(Context.SECURITY_PRINCIPAL,args[0]); env.put(Context.SECURITY_CREDENTIALS,args[1]); try { Context ctx = new InitialContext(env); NamingEnumeration enm = ctx.list(""); while (enm.hasMore()) { System.out.println(enm.next()); } enm.close(); ctx.close(); } catch (NamingException e) { System.out.println(e.getMessage()); } } } ------------------------------------------------------------------------------------------------------------------------ -- # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # example.com dn: dc=example,dc=com dc: example objectClass: top objectClass: domain # People, example.com dn: ou=People,dc=example,dc=com ou: People objectClass: top objectClass: organizationalUnit # Group, example.com dn: ou=Group,dc=example,dc=com ou: Group objectClass: top objectClass: organizationalUnit # nagios, People, example.com dn: uid=nagios,ou=People,dc=example,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount uid: nagios sn: nagios givenName: nagios cn: nagios displayName: nagios uidNumber: 500 gidNumber: 500 userPassword:: gecos: nagios loginShell: /bin/bash homeDirectory: /home/nagios shadowExpire: -1 shadowFlag: 0 shadowWarning: 7 shadowMin: 0 shadowMax: 99999 shadowLastChange: 15496 # test1, People, example.com dn: uid=test1,ou=People,dc=example,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount uid: test1 sn: test1 givenName: test1 cn: test1 displayName: test1 uidNumber: 501 gidNumber: 501 userPassword:: gecos: test1 loginShell: /bin/bash homeDirectory: /home/test1 shadowExpire: -1 shadowFlag: 0 shadowWarning: 7 shadowMin: 0 shadowMax: 99999 shadowLastChange: 16447 # test2, People, example.com dn: uid=test2,ou=People,dc=example,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount uid: test2 sn: test2 givenName: test2 cn: test2 displayName: test2 uidNumber: 502 gidNumber: 502 userPassword:: gecos: test2 loginShell: /bin/bash homeDirectory: /home/test2 shadowExpire: -1 shadowFlag: 0 shadowWarning: 7 shadowMin: 0 shadowMax: 99999 shadowLastChange: 16447 # nagios, Group, example.com dn: cn=nagios,ou=Group,dc=example,dc=com objectClass: posixGroup cn: nagios gidNumber: 500 # test1, Group, example.com dn: cn=test1,ou=Group,dc=example,dc=com objectClass: posixGroup cn: test1 gidNumber: 501 # test2, Group, example.com dn: cn=test2,ou=Group,dc=example,dc=com objectClass: posixGroup cn: test2 gidNumber: 502 # search result search: 2 result: 0 Success # numResponses: 10 # numEntries: 9

2 1

occasional user entry being deleted
by Al 23 Jan '15

23 Jan '15

Hi All - I'm having an odd issue where on a rare occasion (a couple of times a week), a new LDAP user entry is being deleted shortly after it is created. Sometimes it happens within a few minutes, sometimes it happens within an hour or so. I have a 4 way multi-master setup, with all writes being directed at a single server with a load balancer. I have the auditlog enabled (from failed attempts at delta sync) and I see auditDelete entries in the auditdb, but its being executed from the internal admin user, not a "real" user. I do not see anything suspect in my system logs running at the normal loglevel. I'm running 2.4.39 on Redhat 6, x64 with mdb. Below is a snippet of my configuration from the specific database in question. Does anyone know why this might be occurring? Any idea on how to further troubleshoot this issue? Thanks in advance - Al dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /PATH/TO/OPENLDAP/var/openldap-data olcSuffix: dc=company,dc=com olcAddContentAcl: FALSE olcLastMod: TRUE olcLimits: {0}dn.base="XXXXXXX" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=Manager,dc=company,dc=com olcRootPW:: XXXXXXXXX olcSyncUseSubentry: FALSE olcMirrorMode: TRUE olcMonitoring: TRUE olcDbCheckpoint: 512 5 olcDbNoSync: TRUE olcDbIndex: objectClass eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: cn pres,eq,sub olcDbIndex: uid eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: uniqueMember eq olcDbIndex: nisNetgroupTriple eq olcDbIndex: sudoUser eq,sub olcDbIndex: mail eq olcDbIndex: pwmToken eq,sub olcDbIndex: memberOf eq olcDbMaxSize: 25000000000 olcDbMode: 0600 structuralObjectClass: olcMdbConfig entryUUID: xxxx-xxxx-xxxxx-xxxxx creatorsName: cn=config createTimestamp: 20111014131247Z olcSyncrepl: {0}rid=011 provider=ldap://server1:21389/ bind method=simple timeout=0 network-timeout=0 binddn="XXXXXXX" credentials="XXXX" keepalive=0:0:0 startt ls=critical filter="(objectclass=*)" searchbase="dc=company,dc=com" scope=sub schemachecking=off type=refreshOnly retry="30 +" interval=00:00:00:30 olcSyncrepl: {1}rid=012 provider=ldap://server2:21389/ bind method=simple timeout=0 network-timeout=0 binddn="XXXXXXX" credentials="XXXX" keepalive=0:0:0 startt ls=critical filter="(objectclass=*)" searchbase="dc=company,dc=com" scope=sub schemachecking=off type=refreshOnly retry="30 +" interval=00:00:00:30 olcSyncrepl: {2}rid=013 provider=ldap://server3:21389/ bind method=simple timeout=0 network-timeout=0 binddn="XXXXXXX" credentials="XXXX" keepalive=0:0:0 startt ls=critical filter="(objectclass=*)" searchbase="dc=company,dc=com" scope=sub schemachecking=off type=refreshOnly retry="30 +" interval=00:00:00:30 olcSyncrepl: {3}rid=014 provider=ldap://server4:21389/ bind method=simple timeout=0 network-timeout=0 binddn="XXXXXXX" credentials="XXXX" keepalive=0:0:0 startt ls=critical filter="(objectclass=*)" searchbase="dc=company,dc=com" scope=sub schemachecking=off type=refreshOnly retry="30 +" interval=00:00:00:30 entryCSN: 20140924095732.634049Z#000000#001#000000 modifiersName: cn=Manager,cn=config modifyTimestamp: 20140924095732Z

5 6

Creating LDAP schema issue
by Leander Schäfer 23 Jan '15

23 Jan '15

Hi Unfortunately I'm struggeling, since since 2.5 days. I have to create individual a LDAP schema which suits the currently used LDAP structure. The current tructure looks like this: => dc=MyDomain,dc=TLD ==> ou=People ===> uid=User-1 ====> ou=mail ===> uid=User-2 ====> ou=mail ... and so on ... Within ou=mail should be the individual mail account(s) information of a user. So in the end I want to add a(nother) mail account by something like this: cat << EOF > ./newUser.ldif dn: mailAddress=Test(a)Domain.TLD,ou=mail,uid=User-1,ou=people,dc=MyDomain,dc=TLD objectclass: top objectclass: mailAccount mailAddress: Test(a)Domain.TLD MailPassword: {SSHA}SomePassword MailAccountStatus: active [...] EOF Therefore I setup a LDAP schema like the following, but it seems to ignore the attributes "MailPassword" and "noMailAccountStatus". Why? I don't understand what I'm missing here on my objectclass? I'm sure it is an easy little thing to fix - but I just can't figure it out with the tutarials provided I went thorugh ;/ # ====================== LDAP schema ======================= # # # OID Macros (10001 should be IANA-registered) # objectidentifier nameSpace 1.3.6.1.4.1.10001 objectidentifier mail nameSpace:1 objectidentifier objectClassAccount mail:1 objectidentifier objectClassAccountInfo mail:2 # # Attributes: objectClass[NAME]:1.[SERIAL] # attributetype ( objectClassAccount:1.1 NAME 'mailAddress' DESC 'The hosted mail addresses' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE ) attributetype ( objectClassAccount:1.2 NAME 'MailPassword' DESC 'The hosted mail password' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128} ) attributetype ( objectClassAccount:1.3 NAME 'MailAccountStatus' DESC 'The status of a user account: active, noaccess, disabled, deleted' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) [...] # # Objects: objectClass[NAME]:2.[SERIAL] # objectclass ( objectClassAccount:2.1 NAME 'mailAccount' SUP ( top ) STRUCTURAL DESC 'Mail account' MUST ( mailAddress ) MAY ( MailPassword $ MailAccountStatus ) ) # ====================================================== # Thanks Best Regards, Leander

2 1

Replication
by sofien BLOUZA 22 Jan '15

22 Jan '15

Hi all, Is it possible to associate multi-master Replication and delta-syncrepl ? Thunks a lot ? Sofiene BLOUZA -- Sofiene BLOUZA Ingénieur R & D 0645492223

1 0

LDAP Search with non-existent attributes
by Dirk-Willem van Gulik 21 Jan '15

21 Jan '15

W’re comparing various LDAP server setups; and we are wondering what the ‘correct’ search result is for a search which is done such as '(|(|(|(givenname=fred*)(sn=fred*)(mail=fred*)(cn=fred*) in a situation where we have records which do not have a certain attribute (e.g. no givenname or cn) — e.g. a record as light weight as: dn: uid= 1234 objectClass: person uid: 1234 sn: fred fred telephoneNumber: 1234 As we notice that some servers will return this given above query; and some do not. And I cannot find the exact spot in the RFC where the ‘correct’ behaviour is mentioned. Would anyone have a pointer or a suggestion ? And would OpenLDAP 2.4 be intentionally more accommodating than the spec ? Dw.

2 2

Access to dn.subtree with dnatrr=attrname
by Tomasz Lesniewski 20 Jan '15

20 Jan '15

Hi. I have ldap tree which i'm trying to migrate from 389-ds to openldap, with structure like this: o=company ou=admins uid=admin1 ... dc=domain ou=users uid=user1 service=service1 ... uid=user2 service=service2 At uid=user1,ou=users,dc=domain,o=company there is admin entry (and no admin entry in childrens) which points to uid=admin1,ou=admins,o=company. Now i want to grant access to all entries below uid=user1,ou=users,dc=domain,o=company to uid=admin1. In 389-ds it was easy, but in openldap it seems not easy to do. I tried to use: olcAccess: to dn.subtree="uid=*,ou=users,dc=domain,o=company" by dnattr="admin" but it grant access only uid=user1,ou=users,dc=domain,o=company and for no childrens access is granted. Maybe i'm doing something wrong or should i use other functionality to solve this problem? Any help will be appreciate. -- Pozdrawiam/Best regards Tomasz Leśniewski

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical