openldap-technical

openldap-technical@openldap.org

7 participants
9901 discussions

access control with pbind overlay
by Ferenc Wagner 29 Sep '14

29 Sep '14

Hi, I've got a partial syncrepl replica, which (among others) misses the userPassword attributes of the provider database. I added a pbind overlay to the replica, which forwards binds to the provider, thus it became possible to do simple binds against the replica. But access control on the replica does not honor these binds properly: "by users" works, but "by self" does not. Before I waste too much time debugging: is it supposed to work at all? I tested this under 2.4.31 with: dn: olcDatabase={1}mdb,cn=config olcAccess: to * by dn.exact=gidNumber=119+uidNumber=116,cn=peercred,cn=external,cn=auth read by self read by * none olcSyncrepl: rid=1 [...] The external auth part works, and if I replace self with users, that works as well (but is not what I want). Do I expect too much? -- Thanks, Feri.

2 5

can a automountMap be associated with a nisNetgroup
by Dal tee 26 Sep '14

26 Sep '14

Hi, I'm trying to see if I can control which mounts get mounted based on a servers netgroup membership. I suppose the first question is... Can it be done. I'm using an openldap client on RHEL 6.2 accessing AD. Has anyone got a working example they can walk through ?

1 0

Help: Query unmodified non SSHA userPasswords
by Ulrich Windl 25 Sep '14

25 Sep '14

Hi! I'd like to query userPassword attributes that don't start with "{SSHA", but it seems substring match doesn't work there. An addition I'd like to find those users that didn't change their password since the user was created, i.e. modifyTimestamp=createTimestamp, but I think that's not possible in a search filter as the right of '=' is interpreted literally, right? Any ideas? Regards, Ulrich

4 5

Sync Repl - mirror mode - rid=001 LDAP_RES_INTERMEDIATE - REFRESH_DELETE
by Sterling Sahaydak 25 Sep '14

25 Sep '14

I've upgraded my 2 ldap servers to 2.4.39 and have been trying to get mirror mode to work with no luck. I've removed out for now TLS and using ldap:/// The issue I've had since 2.4.23 version and now is "LDAP_RES_INTERMEDIATE - REFRESH_DELETE" Everything else works but have run into this issue that can't resolve. I've looked up in the forum for other references to this, but not seeing a clear resolution. Others, keep getting additional messages beyond this, but mine stops at this. I've tried running also with slapd -h "ldapi:/// ldap:///" -d 7 but getting stuck as well Your help is greatly appreciated! [root@ldap-east ~]# slapd -d sync 54243242 @(#) $OpenLDAP: slapd 2.4.39 (Sep 17 2014 15:14:19) $ root@admin.xxxxx.net:/root/rpmbuild/BUILD/openldap-2.4.39/openldap-2.4.39/servers/slapd 54243242 /etc/openldap/slapd.conf: line 226: rootdn is always granted unlimited privileges. 54243242 slapd starting 54243242 do_syncrep2: rid=001 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Provider/Master side - slapd.conf (ldap-east) ------------------------------------------- include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/sudo.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/lib/openldap modulepath /usr/lib64/openldap moduleload accesslog.la moduleload rwm.la moduleload syncprov.la disallow bind_anon moduleload back_bdb moduleload back_ldap backend bdb database monitor access to * by dn.exact="cn=Manager,dc=xxxxx,dc=net" read by * none database bdb suffix "dc=xxxxx,dc=net" checkpoint 1024 15 rootdn "cn=Manager,dc=xxxxx,dc=net" rootpw xxxxx directory /var/lib/ldap access to * by dn.base="cn=TestSync,ou=Roles,dc=xxxxx,dc=net" write by * break access to attrs=userPassword,shadowLastChange by dn="cn=Manager,dc=xxxxx,dc=net" write by anonymous auth by self write by * none index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN,entryUUID eq serverID 1 overlay syncprov syncprov-checkpoint 100 1 syncprov-sessionlog 100 #LDAP Sync - Slave syncrepl rid=001 provider=ldap://ldap-west.xxxxx.net bindmethod=simple binddn="cn=TestSync,ou=Roles,dc=xxxxx,dc=net" credentials="xxxxxx" searchbase="dc=xxxxx,dc=net" schemachecking=off type=refreshAndPersist retry="60 +" filter="(objectclass=*)" attrs="*,+" mirrormode on loglevel -1 Consumer/Slave side - slapd.conf (ldap-west) - only difference is the replication section ------------------------------------------- .... serverID 2 overlay syncprov syncprov-checkpoint 100 1 syncprov-sessionlog 100 #LDAP Sync - Master syncrepl rid=001 provider=ldap://ldap-east.xxxxx.net bindmethod=simple binddn="cn=TestSync,ou=Roles,dc=xxxxx,dc=net" credentials="xxxxxx" searchbase="dc=xxxxx,dc=net" schemachecking=off type=refreshAndPersist retry="60 +" filter="(objectclass=*)" attrs="*,+" mirrormode on

1 0

(ITS#7274) delta-syncrepl MMR infinite loop - like issue?
by Francesco Malvezzi 25 Sep '14

25 Sep '14

During the setup of a mirror mode cluster, I enabled the syncprov after building the mirror. So maybe I run into ITS#7274: http://www.openldap.org/its/index.cgi/Documentation?id=7274;selectid=7274;s… delta-syncrepl fails with: 1) ABANDON log messages on provider; 2) matching "delta-sync lost" log messages on consumer. Do I understand correctly: provider needs contextCSN value for SID=0 in order to have delta-syncrepl working? Does the following query confirm the lack of the contextCSN value for SID=0? ldapsearch -ZZ -h ldap.example.org -LLL -x -s base -b dc=example,dc=org contextCSN dn: dc=example,dc=org contextCSN: 20140925113354.230424Z#000000#001#000000 contextCSN: 20140925113307.523494Z#000000#002#000000 If the mirror mode cluster is in production, do I have any hope to setup delta-syncrepl? Thank you, Francesco

1 0

slapo-refint not working on consumer.
by Mike Hulsman 25 Sep '14

25 Sep '14

Hi, When testing slapo-refint functionality in a configuration with mirror node masters, and a Delta-syncrepl consumer. I see that refint is working between the 2 providers, but not on the consumer. Using Openldap 2.4.39 on all instances. Database is hdb After renaming a uid the ContextCSN on all instances are the same, so changes are propagated successful. Every change if replicated properly, except for refint on a consumer. The refint configuration: overlay refint refint_attributes uniqueMember refint_nothing cn=Manager,o=test The logfile on the consumer: Sep 23 17:05:12 sldapa01 slapd[1727]: do_syncrep2: rid=101 cookie=rid=101,sid=001,csn=20140923150512.298991Z#000000#001#000000 Sep 23 17:05:12 sldapa01 slapd[1727]: syncrepl_message_to_entry: rid=101 DN: uid=108284.22593,ou=users,o=test, UUID: 7d4fb488-a789-1033-9f1d-cd9d692f2885 Sep 23 17:05:12 sldapa01 slapd[1727]: syncrepl_entry: rid=101 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) Sep 23 17:05:12 sldapa01 slapd[1727]: => bdb_filter_candidates Sep 23 17:05:12 sldapa01 slapd[1727]: #011AND Sep 23 17:05:12 sldapa01 slapd[1727]: => bdb_list_candidates 0xa0 Sep 23 17:05:12 sldapa01 slapd[1727]: => bdb_filter_candidates Sep 23 17:05:12 sldapa01 slapd[1727]: #011EQUALITY Sep 23 17:05:12 sldapa01 slapd[1727]: <= bdb_filter_candidates: id=1 first=102822 last=102822 Sep 23 17:05:12 sldapa01 slapd[1727]: <= bdb_list_candidates: id=1 first=102822 last=102822 Sep 23 17:05:12 sldapa01 slapd[1727]: <= bdb_filter_candidates: id=1 first=102822 last=102822 Sep 23 17:05:12 sldapa01 slapd[1727]: => test_filter Sep 23 17:05:12 sldapa01 slapd[1727]: EQUALITY Sep 23 17:05:12 sldapa01 slapd[1727]: <= test_filter 6 Sep 23 17:05:12 sldapa01 slapd[1727]: syncrepl_entry: rid=101 be_search (0) Sep 23 17:05:12 sldapa01 slapd[1727]: syncrepl_entry: rid=101 uid=108284.22593,ou=users,o=test Sep 23 17:05:12 sldapa01 slapd[1727]: slap_queue_csn: queing 0x7ff278108d90 20140923150512.298991Z#000000#001#000000 Sep 23 17:05:12 sldapa01 slapd[1727]: slap_graduate_commit_csn: removing 0x7ff27b1f5150 20140923150512.298991Z#000000#001#000000 Sep 23 17:05:12 sldapa01 slapd[1727]: syncrepl_entry: rid=101 be_modrdn uid=118284.22593,ou=users,o=test Sep 23 17:05:12 sldapa01 slapd[1727]: slap_queue_csn: queing 0x7ff278108d90 20140923150512.298991Z#000000#001#000000 Sep 23 17:05:12 sldapa01 slapd[1727]: slap_graduate_commit_csn: removing 0x7ff27b1f3260 20140923150512.298991Z#000000#001#000000 Logfile on mirror mode master: Sep 23 17:05:11 mldapa01 slapd[2237]: do_syncrep2: rid=100 cookie=rid=100,sid=001,csn=20140923150512.298991Z#000000#001#000000 Sep 23 17:05:11 mldapa01 slapd[2237]: syncrepl_message_to_entry: rid=100 DN: uid=108284.22593,ou=users,o=test, UUID: 7d4fb488-a789-1033-9f1d-cd9d692f2885 Sep 23 17:05:11 mldapa01 slapd[2237]: syncrepl_entry: rid=100 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) Sep 23 17:05:11 mldapa01 slapd[2237]: => bdb_filter_candidates Sep 23 17:05:11 mldapa01 slapd[2237]: #011AND Sep 23 17:05:11 mldapa01 slapd[2237]: => bdb_list_candidates 0xa0 Sep 23 17:05:11 mldapa01 slapd[2237]: => bdb_filter_candidates Sep 23 17:05:11 mldapa01 slapd[2237]: #011EQUALITY Sep 23 17:05:11 mldapa01 slapd[2237]: <= bdb_filter_candidates: id=1 first=102822 last=102822 Sep 23 17:05:11 mldapa01 slapd[2237]: <= bdb_list_candidates: id=1 first=102822 last=102822 Sep 23 17:05:11 mldapa01 slapd[2237]: <= bdb_filter_candidates: id=1 first=102822 last=102822 Sep 23 17:05:11 mldapa01 slapd[2237]: => test_filter Sep 23 17:05:11 mldapa01 slapd[2237]: EQUALITY Sep 23 17:05:11 mldapa01 slapd[2237]: <= test_filter 6 Sep 23 17:05:11 mldapa01 slapd[2237]: syncrepl_entry: rid=100 be_search (0) Sep 23 17:05:11 mldapa01 slapd[2237]: syncrepl_entry: rid=100 uid=108284.22593,ou=users,o=test Sep 23 17:05:11 mldapa01 slapd[2237]: slap_queue_csn: queing 0x7f270b394ad0 20140923150512.298991Z#000000#001#000000 Sep 23 17:05:11 mldapa01 slapd[2237]: syncprov_matchops: skipping original sid 001 Sep 23 17:05:11 mldapa01 slapd[2237]: slap_graduate_commit_csn: removing 0x7f27120a2200 20140923150512.298991Z#000000#001#000000 Sep 23 17:05:11 mldapa01 slapd[2237]: syncprov_matchops: skipping original sid 001 Sep 23 17:05:11 mldapa01 slapd[2237]: => bdb_filter_candidates Sep 23 17:05:11 mldapa01 slapd[2237]: #011AND Sep 23 17:05:11 mldapa01 slapd[2237]: => bdb_list_candidates 0xa0 Sep 23 17:05:11 mldapa01 slapd[2237]: => bdb_filter_candidates Sep 23 17:05:11 mldapa01 slapd[2237]: #011OR Sep 23 17:05:11 mldapa01 slapd[2237]: => bdb_list_candidates 0xa1 Sep 23 17:05:11 mldapa01 slapd[2237]: => bdb_filter_candidates Sep 23 17:05:11 mldapa01 slapd[2237]: #011EQUALITY Sep 23 17:05:11 mldapa01 slapd[2237]: syncrepl_entry: rid=100 be_modrdn uid=118284.22593,ou=users,o=test Sep 23 17:05:11 mldapa01 slapd[2237]: <= bdb_filter_candidates: id=0 first=0 last=0 Sep 23 17:05:11 mldapa01 slapd[2237]: => bdb_filter_candidates Sep 23 17:05:11 mldapa01 slapd[2237]: #011OR Sep 23 17:05:11 mldapa01 slapd[2237]: => bdb_list_candidates 0xa1 Sep 23 17:05:11 mldapa01 slapd[2237]: => bdb_filter_candidates Sep 23 17:05:11 mldapa01 slapd[2237]: #011EXT Sep 23 17:05:11 mldapa01 slapd[2237]: <= bdb_filter_candidates: id=-1 first=1 last=102893 Sep 23 17:05:11 mldapa01 slapd[2237]: <= bdb_list_candidates: id=-1 first=1 last=102893 Sep 23 17:05:11 mldapa01 slapd[2237]: <= bdb_filter_candidates: id=-1 first=1 last=102893 Sep 23 17:05:11 mldapa01 slapd[2237]: <= bdb_list_candidates: id=-1 first=1 last=102893 Sep 23 17:05:11 mldapa01 slapd[2237]: <= bdb_filter_candidates: id=-1 first=1 last=102893 Sep 23 17:05:11 mldapa01 slapd[2237]: <= bdb_list_candidates: id=-1 first=1 last=102893 Sep 23 17:05:11 mldapa01 slapd[2237]: <= bdb_filter_candidates: id=-1 first=1 last=102893 Sep 23 17:05:11 mldapa01 slapd[2237]: => test_filter Sep 23 17:05:11 mldapa01 slapd[2237]: OR Sep 23 17:05:11 mldapa01 slapd[2237]: => test_filter_or Sep 23 17:05:11 mldapa01 slapd[2237]: => test_filter Sep 23 17:05:11 mldapa01 slapd[2237]: EXT Sep 23 17:05:11 mldapa01 slapd[2237]: <= test_filter 5 Sep 23 17:05:11 mldapa01 slapd[2237]: <= test_filter_or 5 Sep 23 17:05:11 mldapa01 slapd[2237]: <= test_filter 5 Sep 23 17:05:11 mldapa01 slapd[2237]: => test_filter

2 3

way to validate server certificate
by Bin Lu 24 Sep '14

24 Sep '14

Hi, Does openldap provide APIs to do server certificate validation? Can I retrieve the server cert from LDAP connection and do the validation myself or by passing the trusted CA list openldap will do it (in this case, how the hostname matching with the subject DN is performed)? Thanks a lot in advance, -blu

6 11

Delta-syncrepl Consumer refresh entry
by unimore 24 Sep '14

24 Sep '14

Hi all, once in a while, a modification entry in cn=accesslog on provider is lost by consumer (both openldap-2.4.39). Later modifies on the same entry are cought up, but entry is now inconsistent. If I am right, eventually a "janitor process" recognizes messed up entries and fixes them, but in my limited scenario it could take hours. Is there a way to force consumer to refresh a given entry? Thank you for your patience, Francesco

2 1

unique overlay on a per branch basis
by Craig White 24 Sep '14

24 Sep '14

Assuming branches like: ou=people,ou=company1,dc=example,dc=com ou=people,ou=company2,dc=example,dc=com Is it possible to use a regular expression in the configuration to ensure a unique uid attribute in each branch but allow an identical uid attribute in different companies like: uid=Bob,ou=people,ou=company1,dc=example,dc=com uid=Bob,ou=people,ou=company2,dc=example,dc=com I ask because the man page for slapo-unique seems to suggest only absolute dn's Craig White System Administrator O 623-201-8179 M 602-377-9752 [cid:image001.png@01CF86FE.42D51630] SkyTouch Technology 4225 E. Windrose Dr. Phoenix, AZ 85032

2 1

troubles while setting-up ldap server + pam
by Ivaylo Ganchev 24 Sep '14

24 Sep '14

Hello, I am installing openldap in my cathedra and am running into a strange problem. Currently I configured the server and imported some entries (from the existing nis base). Then I set-up a client station. Unfortunately I am currently unable to log-in with a user account on the client station. The strange problem consists in the following : - When I use libnss_ldap and libpam_ldap the client sends multiple requests, receives multiple answers (with correct values for the given user), but then at one moment the server sends a FIN,ACK packet and in the auth.log of the client machine I see a message saying "failed to bind to ldap server" or something like this. I get this information from a network analyzer. From the server side everything seems OK. - When I use libnss_ldapd and libpam_ldapd, the communication is OK, but it seems that the client is not asking for the userPassword agrument and so, there is no way to login (it only asks for "loginShell cn gidNumber uidNumber objectClass homeDirectory gecos uid" and then in another request "shadowExpire shadowInactive shadowFlag shadowWarning shadowLastChange uid shadowMin shadowMax" I am able to make a ldapsearch from the client side with the binddn specified in the pam_ldap.conf and libnss_ldap.conf and all the information is successfully retrieved. Any advices are welcomed. Thanks, -- Ivaylo

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical