openldap-technical

openldap-technical@openldap.org

14 participants
9796 discussions

need serious help on replication over ssl - getting do_syncrep1: rid 001 ldap_sasl_bind_s failed (-1)
by wailok tam 01 Dec '14

01 Dec '14

Hi, I would really be grateful if a nice guy would appear and save me with this one. Simple bind replication over ldaps port does not work. I don't have a clue. There are very few guides on setting up replication over ldaps on the web or on prints. I am following this one as I am using RH: Technical blurb about Oracle Engineered Systems: Configuring OpenLDAP for High Availability. (Master/Slave or Provider/Consumer configuration) [Part 3 of 4] Some of the suspicious bit are: 1. Concatenating the master CA cert and the original slave CA cert to make a new CA cert for use with the slave. But the server cert and key in the slave was signed with the original slave CA without the concatenation.2. the following line:tls_cert= in the slave replication directive seems to be suggesting the location of the master server certificate in the guide but there is no clear mention. I put the location of the master server certificate in this line. A billion thanks in advance. First the master slapd.conf: include /etc/openldap/schema/core.schemainclude /etc/openldap/schema/cosine.schemainclude /etc/openldap/schema/inetorgperson.schemainclude /etc/openldap/schema/nis.schemainclude /etc/openldap/schema/samba.schema # Allow LDAPv2 client connections. This is NOT the default.allow bind_v2 pidfile /var/run/openldap/slapd.pidargsfile /var/run/openldap/slapd.args ######################################################################## ldbm and/or bdb database definitions####################################################################### database bdbsuffix "dc=ier,dc=hit-u,dc=ac,dc=jp"rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp"rootpw sameforalldirectory /var/lib/ldap TLSCACertificateFile /usr/share/ssl/certs/nii-odca2.crtTLSCertificateFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crtTLSCertificateKeyFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.key overlay syncprovsyncprov-checkpoint 50 10syncprov-sessionlog 100 # Indices to maintain for this databaseindex objectClass eq,presindex ou,cn,mail,surname,givenname eq,pres,subindex uidNumber,gidNumber,loginShell eq,presindex uid,memberUid eq,pres,subindex nisMapName,nisMapEntry eq,pres,subindex entryCSN,entryUUID eq idlcachesize 1000 access to attrs=userPassword by self write by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by anonymous auth by * none access to attrs=SambaLMPassword,SambaNTPassword by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by self read by anonymous auth by * none access to * by self write by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by * read loglevel stats args trace sync ************************************************************************************************************************Next, the slapd.conf of the slave: ### configuration for IER### writeen by T.Tanaka include /etc/openldap/schema/core.schemainclude /etc/openldap/schema/cosine.schemainclude /etc/openldap/schema/inetorgperson.schemainclude /etc/openldap/schema/nis.schemainclude /etc/openldap/schema/samba.schema # Allow LDAPv2 client connections. This is NOT the default.allow bind_v2 # Do not enable referrals until AFTER you have a working directory# service AND an understanding of referrals.#referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pidargsfile /var/run/openldap/slapd.args ######################################################################## ldbm and/or bdb database definitions####################################################################### database bdbsuffix "dc=ier,dc=hit-u,dc=ac,dc=jp"rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp"rootpw sameforalldirectory /var/lib/ldap TLSCACertificateFile /etc/pki/CA/cacert.pemTLSCertificateFile /etc/pki/tls/misc/newcert.pemTLSCertificateKeyFile /etc/pki/tls/misc/clearkey.pem # Replicas of this database # Indices to maintain for this databaseindex objectClass eq,presindex ou,cn,mail,surname,givenname eq,pres,subindex uidNumber,gidNumber,loginShell eq,presindex uid,memberUid eq,pres,subindex nisMapName,nisMapEntry eq,pres,subindex entryCSN,entryUUID eq idlcachesize 1000 access to attrs=userPassword by dn="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" write by self write by anonymous auth by * none access to * by dn="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" write by self write by * read loglevel stats args trace sync syncrepl rid=001 provider=ldaps://mail.ier.hit-u.ac.jp:636 type=refreshOnly interval=00:00:05:00 bindmethod=simple searchbase="dc=ier,dc=hit-u,dc=ac,dc=jp" binddn="uid=root,dc=ier,dc=hit-u,dc=ac,dc=jp" credentials=sameforall tls_cert=/usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt mirrormode onupdateref ldaps://mail.ier.hit-u.ac.jp **************************************************************************************************************************

2 3

Re: OpenLDAP incroyable!
by Quanah Gibson-Mount 01 Dec '14

01 Dec '14

--On Wednesday, November 26, 2014 12:13 PM +0100 Onno van der Straaten <onno.van.der.straaten(a)gmail.com> wrote: > > And....another one. Amazing. So hard to understand the OpenLDAP > interface. Might just as well have been in Chinese. > > > > $ ldapmodify -h zimbra.server.com -p 389 -D "cn=config" -f > olc_password_hash.ldif -W > ldap_initialize( ldap://zimbra.onknows.com:389 ) > Enter LDAP Password: > replace olcPasswordHash: > {SSHA} > modifying entry "olcDatabase={-1}frontend,cn=config" > modify complete > > > So the "modify complete" sort of suggestive of some kind of success > completion or change applied. One would think. No. > > > The olcPasswordHash was "modified complete" to have exact same value as > before. Sort of expected OpenLDAP to be "unwilling to perform", which > often it is. Not now. It just is "willing to ignore". Almost human. Your list of complaints so far: a) You told OpenLDAP to load a file that didn't exist b) You modified a file, by hand, where the first comment in the file is: # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. c) In doing (b), you failed to preserve proper file permissions d) You failed to use the correct tools for doing what you wanted to do, after you broke the configuration (slapcat/slapadd) I'm not really sure what to make of your above complaint. It seems you are saying you think it is an error for ldap to replace a value with itself? All LDAP servers will do that with a replace operation. I.e., there is significant user error present here, and you got yourself into a bad spot, and made it worse via your own actions. A lack of understanding how to use a piece of software does not indicate the software itself is flawed. I will agree that it takes some time to learn how to work with LDAP in general, regardless of it is OpenLDAP, 389, Apache DS, etc. It may indeed be best in your case, to have a graphical UI hiding the grisly details from you, since those details are apparently causing significant challenge in your case. However, in the long run, it pays off significantly to understand the technology you're attempting to use. --Quanah -- Quanah Gibson-Mount Server Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

8 9

ldap update multiple entry by a single command
by Shashi Ranjan 28 Nov '14

28 Nov '14

Hello, I need to update multiple entries in single LDAP modify request for a particular object class. Otherwise I need to first search all the contact and then update one by one. In my case I want to update " l " parameter. l: mysite --> l: newsite Is there any way to update it in single LDAP modify request. dn: cn=test1,ou=comp,ou=people,dc=example,dc= com contactCompany: comp objectClass: cmmContact l: mysite dn: cn=test2,ou=comp,ou=people,dc= example,dc= com contactCompany: comp objectClass: cmmContact l: mysite dn: cn=test3,ou=comp,ou=people,dc= example,dc=com contactCompany: comp objectClass: cmmContact l: mysite P.S.: I am new to OpenLDAP. Thanks & Regards, Shashi Ranjan "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

2 1

Syncrepl N-Way multimaster replication - Configuration issue on Rhel6
by coma 28 Nov '14

28 Nov '14

Hello everybody, i'm currently tring to configure N-Way multimaster replication, and i'm facing two issues with olcServerId and slapd -h options. For information: I'm running on Rhel6.6 with openldap 2.4.39-8. I'm running slapd on non-standard ports (11389 for ldap and ldap with TLS, and 11390 for ldaps) I've tried on standard ports but same issues. I've configured the replication following these two procedures: https://access.redhat.com/solutions/273533 http://www.openldap.org/doc/admin24/replication.html#N-Way%20Multi-Master - First Issue details: When i'm adding olcServerID's on both servers, using following ldif: cat <<EOF | ldapmodify -Y EXTERNAL -H ldapi:/// dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 ldap://server1-test1.test.com olcServerID: 2 ldap://server2-test1.test.com EOF i'm no longer able to restart slapd. Error is: read_config: no serverID / URL match found. Check slapd -h arguments. To resolve it, i've tried to add the URL of my servers in correspondant /etc/sysconfig/ldapExample: SLAPD_LDAP=no SLAPD_LDAPI=yes SLAPD_LDAPS=no SLAPD_URLS="ldap://server1-test1.test.com:11389 ldaps://server1-test1.test.com:11390" But issue "Error is: read_config: no serverID / URL match found." is always present event after a server reboot and a full openldap reinstallationn. - Second issue détails (replication disabled, serverID's removed): With /etc/sysconfig/ldap configured as: SLAPD_LDAP=no SLAPD_LDAPI=yes SLAPD_LDAPS=no SLAPD_URLS="ldap://:11389 ldaps://:11390" i'm able to connect on port 11389/11390 with clear, starttls and SSL using a ldap browser or ldapsearch, But with /etc/sysconfig/ldap configured as: SLAPD_LDAP=no SLAPD_LDAPI=yes SLAPD_LDAPS=no SLAPD_URLS="ldap://server1-test1.test.com:11389 ldaps://server1-test1.test.com:11390" i'm not able to connect anymore. Can you please help me on this? Thanks in advance,

2 2

syncrepl and change in ordering
by Amol Kulkarni 28 Nov '14

28 Nov '14

Hello, I've a openldap 2.4.30 syncrepl setup which is used by our applications. There are over 50 servers in the setup. I want to upgrade our application to the next version. In a single downtime, all servers cannot be upgraded. So the application will be upgraded in phase wise manner. Application upgrade requires some changes in ldap schemas. I want to update the schemas in same phases as the application so as to avoid separate downtime for schema update. I'm planning to update schema on the consumers first and provider last so that during the phases, some servers with old schemas and others with new schemas both replicate properly. schemachecking is set to off on all servers. I understand that new attributes added in schema will not be present on provider at the beginning, so there is no question of their replication. I've compared the schemas and found that none of the attributes is deleted. Only change is that for some attributes we have added 'ordering' and for some we have changed the 'equality'. I'm not using cn=config - if that is a consideration. So will it all work ? Is there a better way? Thanks in advance, Amol Kulkarni.

3 3

Re: ldaps replication question
by wailok tam 27 Nov '14

27 Nov '14

Hi, thanks a lot for your reply. I want to leave the password in text first and go step by step. Do you mind highlighting those lines needed for a SSL thru ldaps configured slave? I find information about modifying another slapd file under etc/defaults on debian base system but I dont know what to do with those on Redhat 5. What is the corresponding file on Rh and what to do in them on the master and slave? ------------------------------ On Wed, Nov 26, 2014 12:57 PM GMT Dieter Klünter wrote: >Am Wed, 26 Nov 2014 06:39:25 +0000 (UTC) >schrieb wailok tam <wailoktam(a)yahoo.com>: > >> Hi, all, >> I cannot get replication to work even I get no error message. I >> change a record on the Master but when I check it on the slave, it >> remains unchanged. (Is it immediate?) The following command on slave: >> ldapsearch -x -h [MASTER HOST NAME] -W -D >> 'cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp' '(uid=tam)' >> returns no error message and gives the expected record. I am >> suspecting I may have screwed up the ssl/tls setting for the slave as >> I dont know what to put there. >[...] > >This is a simplified slapd.conf that may help. > >http://pastebin.com/JcDz6Tkh > >-Dieter > >-- >Dieter Klünter | Systemberatung >http://sys4.de >GPG Key ID: E9ED159B >53°37'09,95"N >10°08'02,42"E

1 0

using ldap database (multiple upstream servers), how to force reconnect after failover?
by David Young 27 Nov '14

27 Nov '14

Hi technical, We have an openldap server (v2.4.39) which acts as a reverse proxy for 2 backend servers (replicated). The intention is that we use this "proxy" server for authentication requests for applications which can't handle SSL, or multiple backend servers, properly. The implementation works as designed - a query is received from a client, passed on to the first server defined in olcDbURL (server1). If the first server is unavailable, after a brief timeout (1 sec), the query is passed to the second server in the oldDbURL (server2). Here's the problem - server1 is never polled again. Queries continue to be passed to server2, but when server2 is unavailable, all queries fail, even if server1 is now available again. Is there a config directive I can use to force ldap to reattempt connection to server1 after the initial failure? My config is below. Thanks :) David --- dn: olcDatabase={1}ldap objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {1}ldap olcSuffix: dc=mydomain,dc=net,dc=nz olcAddContentAcl: FALSE olcLastMod: FALSE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcSyncUseSubentry: FALSE olcMonitoring: FALSE olcDbURI: "ldaps://server1 ldaps://server2" olcDbStartTLS: none starttls=no olcDbRebindAsUser: FALSE olcDbChaseReferrals: TRUE olcDbTFSupport: no olcDbProxyWhoAmI: FALSE olcDbNetworkTimeout: 1 olcDbProtocolVersion: 3 olcDbSingleConn: FALSE olcDbCancel: abandon olcDbUseTemporaryConn: FALSE olcDbConnectionPoolMax: 16 olcDbNoRefs: FALSE olcDbNoUndefFilter: FALSE structuralObjectClass: olcLDAPConfig entryUUID: 01eb5074-6f65-1033-8a02-cd0b00053594 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20140514033850Z olcDbIdleTimeout: 1m olcDbConnTtl: 5m entryCSN: 20140514033850.182221Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20140514033850Z

1 0

Invalid DN errors
by Nick Bright 26 Nov '14

26 Nov '14

Greetings, I hope this is an appropriate mailing list to ask for some assistance. I will state up front that my LDAP experience is extremely limited - essentially noob level. I've been attempting to set up openldap 2.4.39 on CentOS 6 via the official distribution packages. The server is up and running, and my application is connecting successfully, and attempting to add entries to the directory; so I believe I have the most fundamentals in place like the directory manager password, and basic base DN. When connecting with an LDAP browser, I see "dc=valnet,dc=net" which was the configured base DN. When my application attempts to add to the directory it searches for the entry, then adds if the entry isn't found. I'm receiving this error: 54760bfd conn=1003 op=971 do_search: invalid dn: "x500UniqueIdentifier=45270,dc=valnet,dc=net" 54760bfd conn=1003 op=971 SEARCH RESULT tag=101 err=34 nentries=0 text=invalid DN 54760bfd conn=1003 op=972 do_add: invalid dn (x500UniqueIdentifier=45270,dc=valnet,dc=net) 54760bfd conn=1003 op=972 RESULT tag=105 err=34 text=invalid DN I suspect that I am missing some sort of extremely basic configuration item, but I've been having a very very difficult time locating relevant documentation - everything I find in my searches references the old style configuration, not the new style LDIF configuration with cn=config directories, nor have I found any information about how to troubleshoot an "invalid DN" error. It appears that I may be missing a schema file such as inetOrgPerson or nis. The application is attempting to create entries with these attributes: Primary Key: x500UniqueIdentifier Attributes: cn, uid, sn, givenname, userPassword, dn, x500UniqueIdentifier I would appreciate some basic guidance as to what to do, or some direction to the proper documentation or guide for solving "invalid DN" while attempting to add entries to the directory. -- ----------------------------------------------- - Nick Bright - - Vice President of Technology - - Valnet -=- We Connect You -=- - - Tel 888-332-1616 x 315 / Fax 620-331-0789 - - Web http://www.valnet.net/ - ----------------------------------------------- - Are your files safe? - - Valnet Vault - Secure Cloud Backup - - More information& 30 day free trial at - - http://www.valnet.net/services/valnet-vault - -----------------------------------------------

3 5

Setting SSL/TLS options in client code?
by Scott Neugroschl 26 Nov '14

26 Nov '14

Right now, I'm passing an ldaps:// URI to ldap_initialize. I'd like to be able to change the SSL/TLS options before initiating the connection. Is such a thing possible? --- Scott Neugroschl | XYPRO Technology Corporation 4100 Guardian Street | Suite 100 |Simi Valley, CA 93063 | Phone 805 583-2874|Fax 805 583-0124 |

3 2

TLS Configuration
by Hydro Tium 26 Nov '14

26 Nov '14

Hi guys, I'm struggling to configure my OpenLDAP with TLS (openssl) without success. I'm receiving the following error: $ sudo slapd -d 3 ... TLS: gcry_control GCRYCTL_SET_RNDEGD_SOCKET failed 5475ca9c main: TLS init failed: -1 My configuration is the following: dn: cn=config objectClass: olcGlobal cn: config olcPidFile: /var/run/slapd/slapd.pid olcArgsFile: /var/run/slapd/slapd.args olcIdleTimeout: 7 olcLogLevel: conns filter stats none olcReferral: ldap://root.openldap.org olcTLSCACertificateFile: /etc/ssl/certs/My_Root_CA.pem olcTLSCertificateFile: /etc/ssl/certs/My_Root_CA.pem olcTLSCertificateKeyFile: /etc/ldap/server.key.pem olcTLSVerifyClient: demand olcTLSRandFile: /dev/urandom Any clues on how to solve this one?

4 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical