openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

olcObjectClasses: user-defined ObjectClass has inappropriate SUPerior: "dcObject"
by Igor Shmukler 24 Mar '15

24 Mar '15

Hello, I could not find anything exactly relevant quickly. Sorry to bother you good folks, again. I am trying to extend dcObject class in order to support a couple of additional attributes. It is not working, and it appears that the problem is not syntax-related. Is what I am trying to do legal? Is dcObject a good way to go about my goal of adding a DIT-level attributes? Should I instead create another class unrelated to dcObject? If yes, why? Below is my LDIF: olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.100.129 NAME ( 'serviceLevel' ) DESC 'directory service mode. valid values are: trial, standard and premium' SUP name ) olcObjectClasses: ( 1.3.6.1.4.1.4203.666.100.2 NAME 'customDcObject' DESC 'Directory Domain Description' SUP dcObject STRUCTURAL MAY ( serviceLevel ) ) I should probably replace the last MAY for MUST. My attribute should be mandatory. Yet, it is probably not the reason for the error, is it?! Please advise, Sincerely, Igor Shmukler

2 2

Re: How to use ldapsearch -Esync ?
by Thomas Cort 24 Mar '15

24 Mar '15

> I'm writing a script that acts on changes in LDAP. I've abandoned this idea. The ldapsearch utility doesn't decode SyncInfo messages which provide valuable information. Instead, it simply prints "SyncInfo Received". This is worse than printing nothing at all because it causes my LDIF parser to choke. I think either the slapd-perl or slapd-shell backends are better suited to my needs than tailing the output of ldapsearch -Esync/rp Thomas

4 3

are patches important for the openldap installation?
by Wang, Hui 23 Mar '15

23 Mar '15

Hi, all My system admin installed openldap 2.4.40 for me but the slapadd command doesn't work. It seems like the ldap package and slapd package weren't installed. I am installing openldap 2.4.40 on redhat linux server following this direction: http://www.linuxfromscratch.org/blfs/view/svn/server/openldap.html I can't install patch successfully. It only patch a few files then stops. But the make test goes fine. Will there be a problem if the patch doesn't goes fine? You are welcomed for any input. I am very new to openldap. Hui Wang (Holly) CSUN IT Department Identity and Directory Service 818-677-2031 holly.wang(a)csun.edu

3 3

Re: Re: what is wrong with my permissions?
by Igor Shmukler 23 Mar '15

23 Mar '15

Hello Ulrich, Thank you. I finally figured out my problem. I did not notice/realize that permissions were being given in stages: userPassword, dn.base then *. Once I added dn="cn=config" to the correct line, things started working. I appreciate your help. [This is already, at least, the second time.] Sincerely, Igor Shmukler On Mon, Mar 23, 2015 at 4:43 PM, Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: >>>> Igor Shmukler <igor.shmukler(a)gmail.com> schrieb am 19.03.2015 um 15:03 in > Nachricht > <CAA1SNA1h-FRxM=+MHqnTVncZscj-CS5avHbT4NvqcRMnh+_zMA(a)mail.gmail.com>: >> Hi Ferenc, >> >> I am still getting the same error with both by and your versions. Please >> advise: >> >> $ cat set_config_passwd.ldif >> dn: olcDatabase={0}config,cn=config >> changetype: modify >> replace: olcAccess >> olcAccess: {0}to * by >> dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external >> ,cn=auth manage by * break >> olcAccess: {1}to * by dn.exact=cn=config >> >> $ sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f set_config_passwd.ldif >> SASL/EXTERNAL authentication started >> SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth >> SASL SSF: 0 >> modifying entry "olcDatabase={0}config,cn=config" > > Igor, > > you allow cn=config to manage the config database, but below you remove an entry from another database with cn=config credentials. > >> >> $ ldapdelete -x -D cn=config -W cn=john,dc=directory,dc=com >> ldap_delete: Insufficient access (50) >> additional info: no write access to parent >> >> I even tried stripping the first line, so the rule was: {0}to * by >> dn.exact=cn=config >> Still gives me the same error. > > Check the ACL in the other database! > >> >> Please advise, >> >> Igor Shmukler >> >> >> On Thu, Mar 19, 2015 at 2:54 PM, Ferenc Wagner <wferi(a)niif.hu> wrote: >>> Igor Shmukler <igor.shmukler(a)gmail.com> writes: >>> >>>> I want it to be something like: >>>> olcAccess: {1}to * by dn="cn=config" manage >>>> >>>> Basically, I want dn=cn=config to have full root access over >>>> everything. I also want this password ideally to be password >>>> protected. >>>> >>>> Does it make sense? Can it be done? >>> >>> Sure. Add this olcAccess attribute to all the databases. Or to the >>> frontend database, but check man slapd.access for the priorities and >>> defaults. For what it's worth, I use the syntax >>> >>> to * by dn.exact=cn=config >>> >>> (which should be equivalent to yours). >>> -- >>> Feri. > > > >

1 0

LMDB error
by Shu, Xinxin 23 Mar '15

23 Mar '15

Hi list, I'm now working on integrating LMDB with ceph, now I encounter the follow error when initialize transaction : MDB_BAD_RSLOT: Invalid reuse of reader locktable slot What I want to know is in which situation this error occur? thanks Cheers, xinxin

2 1

git problems
by Mattes 22 Mar '15

22 Mar '15

Hello list, while upgrading my local git checkout I just realized that the repository contains serveral files under contrib/ldapc++ that should never be put under version control: l$ git pull Updating 7a7d941..ff7c0e5 error: Your local changes to the following files would be overwritten by merge: contrib/ldapc++/Makefile.in contrib/ldapc++/configure contrib/ldapc++/examples/Makefile.in contrib/ldapc++/src/Makefile.in all these files are generated during the build process (by automake/autoconf) Can someone with commit permission please fix this? TIA Ralf Mattes

2 1

OpenLDAP permissions question
by Igor Shmukler 20 Mar '15

20 Mar '15

Hello, I have been spamming this list, looking for insights into why I cannot configure OpenLDAP to use cn=config to delete an entry inside a DIT. Sorry. Just now thought of and conducted another experiment. The results surprised me. If someone can please explain why OpenLDAP behaves this way, and whether this can be altered through configuration, it would certainly get me further on my way. When I try to delete an entry using LDAPI as below: $ sudo ldapdelete -Y external -H ldapi:/// cn=john,dc=directory,dc=com ldap_delete: Insufficient access (50) additional info: no write access to parent I do the same using domain administrator credentials and below and it works fine: $ ldapdelete -D cn=admin,dc=directory,dc=google,dc=com -W -x cn=john,dc=directory,dc=com Why LDAPI does not work? What can be done? Thank you, Igor Shmukler

8 21

Schema error: attributeType ...
by Zhang,Jun 20 Mar '15

20 Mar '15

This error with a yellow exclamation point caused nothing to be shown on the right panel of the phpldapadmin console. Schema error: attributeType "olmdburilist" inherits from "managedInfo", but attributeType "managedInfo" does not exist. OpenLDAP 2.4.23 RHEL 6 Putting phpldapadmin in debug mode, I did not find anything related to the error message. Jun

2 2

slapd does not log neither to syslog nor systemd' sjournal
by lejeczek 20 Mar '15

20 Mar '15

hi everybody on rhel 7 when I start slapd I see it is running: /usr/sbin/slapd -u ldap -h ldapi:/// ldap://192.168.2.33/ ldaps://192.168.2.33/ -s 160 and yet I don't get anything in rsyslog logs nor in systemd's journal When I stick slapd to terminal with only -d instead of -s everything is as expected. weird, right? any suggestions very appreciated.

1 1

Re: OpenLDAP permissions question
by Marc Patermann 20 Mar '15

20 Mar '15

Igor, Igor Shmukler schrieb (20.03.2015 11:21 Uhr): > Unfortunately, your email does not clear anything, FOR ME. It does not > mean you are not 100% correct. I am just slow, I guess. Sorry. do simple things first! Do more complex things later! - Configure a rootdn with rootpw for each database. Use this to authenticate to slapd und modify things. This works? Fine, go on. - Create a user entry inside your DIT. Use this entry as rootdn. This works? Fine, go on. - Map this user entry from your local unix user with olcAuthzRegexp to use with ldapi and EXTERNAL. This works? Fine, go on. - or make your first steps with ACLs and another user entry. > I don't see why/how Michael's suggestion with olcAuthzRegexp could > work. The way that could have worked - multiple remaps, different for > each database is not allowed. Read again what Michael said: "authz-regexp is a global configuration option." > The one permitted - inside config > database, as far as I understand, does not do what I need. Do you need multiple mappings? As you are one user on your system, this maps to one user in ldap with olcAuthzRegexp. As Micheal already posted: authz-regexp "gidNumber=0\\+uidNumber=0,cn=peercred,cn=external,cn=auth" "cn=root,dc=example,dc=com" uid 0 (from your system) maps to ldap entry cn=root,dc=example,dc=com. Marc

2 6

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical