openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

ldapsearch utf-8 results
by Nicolas Cauchie 01 Jun '14

01 Jun '14

Hello there I use a Debian 7.4 server with ldapsearch to search data about users on an Active Directory database. When a result of a search contains specials characters (such as é, è, à), no result is given, but if I delete special characters to the user profile, it works. How could I make it work with special caracters (guess it's a UTF-8 problem ?) ? Thanks in advance Nicolas -- signature -----

5 6

Incremental ACLs somehow do not work
by Dominik George 31 May '14

31 May '14

Hi, I have these ACLs in place: olcAccess: {0}to dn.base="dc=teckids,dc=org" by group.exact="cn=ldapadmin,ou=Groups,dc=teckids,dc=org" manage by dn="cn=admin,dc=teckids,dc=org" manage by self read continue by * auth break olcAccess: {1}to dn.base="ou=Mailinglists,dc=teckids,dc=org" by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read continue by * break olcAccess: {2}to attrs=userPassword,shadowLastChange,loginShell by self write continue by anonymous auth continue by * break olcAccess: {3}to dn.subtree="ou=People,dc=teckids,dc=org" attrs=cn,uid,loginShell,homeDirectory,uidNumber,gidNumber,gecos by dn="cn=nslcd,dc=teckids,dc=org" read continue by * break olcAccess: {4}to dn.subtree="ou=People,dc=teckids,dc=org" attrs=uid,mailLocalAddress,mailRoutingAddress by dn="cn=postfix,dc=teckids,dc=org" read continue by * break olcAccess: {5}to dn.subtree="ou=Members,ou=People,dc=teckids,dc=org" attrs=employeeNumber by dn.subtree="ou=Board,ou=Members,ou=People,dc=teckids,dc=org" read continue by * none stop olcAccess: {6}to dn.subtree="ou=Members,ou=People,dc=teckids,dc=org" by dn.subtree="ou=Members,ou=People,dc=teckids,dc=org" read continue by * break olcAccess: {7}to dn.subtree="ou=Groups,dc=teckids,dc=org" by dn="cn=nslcd,dc=teckids,dc=org" read continue by * break olcAccess: {8}to dn.subtree="ou=Domains,dc=teckids,dc=org" by dn="cn=postfix,dc=teckids,dc=org" read continue by * break olcAccess: {9}to attrs=cn,uid,userPassword by * auth break But still, even a simple bind fails because it somehow does not get the auth privileges defined in the first stanza. The ACL log says: http://paste.ubuntu.com/7544324/ What did I miss? Cheers, Nik

2 2

Req for How to configure LMDB Database as backend
by Varadharajan S 30 May '14

30 May '14

I'm attempting to setup OpenLDAP 2.4.39 on Ubuntu 14.04 LTS and am getting lost on how to switch from the default hdb/bdb backend to mdb. On http://www.openldap.org/doc/admin24/backends.html#Overview in the 11.4. LMDB section it states: 11.4.2. back-mdb Configuration Unlike the HDB/BDB backends, the mdb backend can be instantiated with very few configuration lines: include ./schema/core.schema database mdb directory ./mdb suffix "dc=example,dc=com" rootdn "cn=mdb,dc=example,dc=com" rootpw mdb maxsize 1073741824 However it doesn't state where to make these entries. After installing OpenLDAP through dpkg or apt-get, I have an /etc/ldap/slapd.d/cn=config directory, which contains a file named olcDatabase={1}hdb.ldif. A grep of the directory returns other files containing various entries referencing hdb. Can anyone advise or provide a link on how to remove the hdb/bdb database configurations and how to use mdb? I've been googling the better part of this morning and while I have found a few howto's and guide's, they all just have bits of "do this" with no specification of where to do it or in what file. Or am I just missing something in general? Also, even if i try to reconfigure through #dpkg-reconfigure slapd doesn't ask while in the database selection ? It's having option to select bdb or hdb only.In our organization we are using 389 DS already and once we saw this LMDB feature in openldap, we are planning to migrate slapd.But while starting itself, we are struck.Please help us on the same.If possible include the clear configurarion steps in the official doc. Regards, Varad

4 6

Quick question re: memberOf and refInt overlays
by Mark Cairney 30 May '14

30 May '14

Hi, I suspect the answer is going to turn out to be blindingly obvious but I noticed this when reviewing my config of the 2 overlays mentioned and I thought this looked a little bit odd: dn: olcOverlay={1}memberof,olcDatabase={1}hdb,cn=config objectClass: olcMemberOf objectClass: olcOverlayConfig olcOverlay: {1}memberof olcMemberOfDangling: ignore olcMemberOfGroupOC: groupOfNames olcMemberOfMemberAD: member olcMemberOfMemberOfAD: memberOf olcMemberOfRefInt: TRUE dn: olcOverlay={3}refint,olcDatabase={1}hdb,cn=config objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcRefintConfig objectClass: top olcOverlay: {3}refint olcRefintAttribute: member olcRefintAttribute: memberOf So I have olcMemberOfRefint set to TRUE in the memberOf overlay and olcRefintAttribute: memberOf set in the refint overlay. Is this correct or should it only be defined in one of these overlays? If it is defined in both overlays as it currently is, can this cause issues such as contention/deadlocking as there are 2 overlays essentially trying to do the same thing. Or does it not actually matter? I'm using an HDB backend just in case that makes any difference. Kind regards, Mark -- /**************************** Mark Cairney ITI UNIX Section Information Services University of Edinburgh Tel: 0131 650 6565 Email: Mark.Cairney(a)ed.ac.uk *******************************/ The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

1 0

On-disk-format of back-mdb depends on LDAP syntax?
by Michael Ströder 29 May '14

29 May '14

HI! Does the on-disk-format of back-mdb depends on which LDAP syntax is used for an attribute? So if the LDAP syntax for an an existing attribute would change I have to reimport the MDB? Background: I've changed (as a work-around for a broken client software) the LDAP syntax of a custom attribute from Boolean to IA5String. After that I could still read the attribute. But when deleting the attribute slapd returned noSuchAttribute(16). I had to remove the whole entry. BTW: No index configured this attribute. Ciao, Michael.

2 3

Making sure this is a real issue before I submit it
by Mark Henning 29 May '14

29 May '14

Good Afternoon, I am in the process of building an LDAP schema which has a number of attributes which will be constrained to specific values. I have run into an issue where slaptest will build the ldif file without syntax errors, but when slapd starts up it can't find the X-ENUM syntax defined in the same file. # service slapd start Checking configuration files for slapd: [FAILED] olcAttributeTypes: value #0 olcAttributeTypes: Syntax not found: "1.3.6.1.4.1.39235.2.3.500" config error processing cn={5}test,cn=schema,cn=config: olcAttributeTypes: Syntax not found: "1.3.6.1.4.1.39235.2.3.500" slaptest: bad configuration file! [root@DNEAA18S2 openldap]# slapd -V @(#) $OpenLDAP: slapd 2.4.23 (Jan 28 2014 09:30:02) $ mockbuild(a)x86-022.build.eng.bos.redhat.com: /builddir/build/BUILD/openldap-2.4.23/openldap-2.4.23/build-servers/servers/slapd I have simplified the problem to a single syntax, attribute and object class. The .schema file and resulting ldif are attached. Is this a legitimate issue to report, or have I made some subtle syntax / contextual error that is preventing the attribute from finding the syntax? Cordially, -Mark Henning

2 1

Use active directory to check password but keep all user data in LDAP
by Mattias Segerdahl 28 May '14

28 May '14

Hello, I was wondering if it is possible to configure OpenLDAP 2.4 to only check the password validation with Active Directory and have the rest of the user attributes, such as mail, loginShell, homeDirectory, etc. come from OpenLDAP? Any pointers, guides, howto’s or even “let me google that for you” are highly appreciated. Cheers Mattias

5 4

RDN
by Artur Nike 27 May '14

27 May '14

Hi all, Is the suffix dc=example,dc=com in tree is a valid rdn ? and whether the drawing http://www.zytrax.com/books/ldap/ch2/dit-dn-rdn.pngis correct? Regards Mariusz

5 6

Fwd: Re: ldapsearch utf-8 results
by Nicolas Cauchie 27 May '14

27 May '14

Le 26/05/2014 10:02, Matthias Apitz a écrit : > El día Monday, May 26, 2014 a las 09:18:38AM +0200, Nicolas Cauchie escribió: > >> Hello there >> I use a Debian 7.4 server with ldapsearch to search data about users >> on an Active Directory database. >> When a result of a search contains specials characters (such as é, >> è, à), no result is given, but if I delete special characters to the >> user profile, it works. >> How could I make it work with special caracters (guess it's a UTF-8 >> problem ?) ? >> Thanks in advance >> Nicolas > Hi Nicolas, > > Are you sure that no results are returned? Can you show the output of a > ldapsearch cmd-line tool? I saw that in the result values are encoded if > they contain non ASCII chars. > > matthias Yes, I wrote it in a previous answer. The result is base64 encoded if "-t" switch is not used, or sent to a temp file if this switch is used. But in both cases, I can't use the result "as is" without another manipulation, but i'm stuck.. Thanks signature -----

4 5

New LDAP installation ?
by Michael Maymann 27 May '14

27 May '14

Hi List, I'm new to setting up LDAP so please be nice... :) I would like to achieve: - SingleSignOn using AD username/password on my Linux servers (currently we are running NIS) - use strong encryption (very least no username/passwords in clear text) - be able to keep current NIS uid/gid(s) - use autofs on my linux servers - For my purpose - would I need to populate/maintain a LDAP tree or would other tools e.g. winbind be sufficient ? - Does anyone have experience with puppet module torian-ldap that could give an example of their manifest ? Thanks in advance :) ! Br. ~maymann

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical