openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

Locale dependent collation for server side sorting
by Jonas Israelsson 26 May '14

26 May '14

Greetings. We have some challenges regarding Server Side Sorting, where is does not really sort the way we want it to. In UTF-8 the character Ä/ä (c3 85/c3 a4) comes before Å/å (c3 84/c3 a5) whereas in our (swedish) alphabetic order it should be the other way around. Server Side Sorting seem to blindly fall back on the sorting order of UTF-8 isrjo@svarde:~> ldapsearch -E 'sss=sn:caseIgnoreOrderingMatch' -x -H ldaps://myserver:636 -D uid=myuser,ou=applications,o=myorg -w mypass -b ou=people,o=myorg -s sub gn=sortme sn gn description # extended LDIF # # LDAPv3 # base <ou=people,o=myorg> with scope subtree # filter: gn=sortme # requesting: sn gn description # with server side sorting control # # angla, people, Myorg dn:uid=angla,ou=people,o=Myorg givenName: sortme sn:: w4RuZ2x1bmQ= description: SN BEGINNING WITH LATIN CAPITAL LETTER A WITH DIAERESIS # 19f98ab4-7beb-4703-82ec-df970944ef30, people, Myorg dn: cn=19f98ab4-7beb-4703-82ec-df970944ef30,ou=people,o=Myorg sn:: w4VrZXNzb24= givenName: sortme description: SN BIGGING WITH LATIN CAPITAL LETTER A WITH RING ABOVE # search result search: 2 result: 0 Success control: 1.2.840.113556.1.4.474 false MAMKAQA= sortResult: (0) Success # numResponses: 3 # numEntries: 2 I fail in openldap to find any matching rule or any other way such as setting the locale before starting the slapd daemon that changes the sorting order. Does anyone know if it is possible to specify a locale dependent collation for server side sorting? Rgds Jonas

3 4

Fwd: Re: ldapsearch utf-8 results
by Nicolas Cauchie 26 May '14

26 May '14

Le 26/05/2014 09:51, Howard Chu a écrit : > Nicolas wrote: >>> Hello there >>> >>> I use a Debian 7.4 server with ldapsearch to search data about users >>> on an >>> Active Directory database. >>> >>> When a result of a search contains specials characters (such as é, >>> è, à), no >>> result is given, but if I delete special characters to the user >>> profile, it >>> works. >>> >>> How could I make it work with special caracters (guess it's a UTF-8 >>> problem ?) ? >>> >>> Thanks in advance >>> >>> Nicolas >>> -- >>> signature ----- >>> >>> >>> >> No one could help me ? > > Sounds like a question for Microsoft. The OpenLDAP ldapsearch command > prints out whatever data it receives from the remote server. If the > remote server isn't sending you what you expect, then get help from > that server's support team. > Hello, (including others users reply) I just found one thing (obviously, you know it, not me...): - When a result containing specials caracters and when I use "-t" switch, my result is sent to a file under /tmp folder : the result is well-readable, with every accent everywhere they should be : it fits me. - When a result containing specials caracters and when I don't use "-t" switch, the result is base64 encoded. So, I have 2 solutions : - Read the /tmp/*.file and export the content to my scripts variable, but I can't guess the name of this file : for example, there's the name of a company's user search : "ldapsearch-company-_8K2vOo_" - Decode the result wich was base64 encoded, but I can't guess if the result will contain special caracter or not. And if i decode a string wich doesn't contain special caracters, it crashes, telling me it's not base64 content... What must I do ? Thanks a lot guys Nicolas

1 0

posixgroups vs groupofnames
by Doug OLeary 25 May '14

25 May '14

Hey; Here's the end goal: Have the ability to have posixgroup style support for gid <-> group_name translation and the ability to use memberof style searches without data duplication. In short: # ldapsearch -xLLL -s sub '(uid=doleary)' memberof dn: uid=doleary,ou=users,dc=oci,dc=com memberOf: cn=infra,ou=groups,dc=oci,dc=com memberOf: cn=ldap-Administrators,ou=groups,dc=oci,dc=com memberOf: cn=infosec,ou=groups,dc=oci,dc=com memberOf: cn=dba,ou=groups,dc=oci,dc=com and # groups doleary doleary : ldap-users ldap-Administrators infosec infra Using a standard rfc2307 install, the only way I was able to get there was by having duplicate groups, one posix and one groupofnames. I've been playing around with rfc2307bis the last few days. While I'm able to have one group, in order to support the desired functionality, I still have to have two member types in that group - member and memberuid: # ldap -search cn=infra ----------------------------------------------------------------------- dn:cn=infra,ou=groups,dc=oci,dc=com cn: infra objectClass: top groupOfNames posixGroup member: cn=admin,dc=oci,dc=com uid=doleary,ou=users,dc=oci,dc=com description: System Admins gidNumber: 610 memberUid: doleary Short version: is there a way to achieve this ability without duplicating data? Any info greatly appreciated. Thanks for your time. Doug O'Leary ------------ Senior UNIX/Security Admin CISSP, CISA, RHCE, CEH O'Leary Computers Inc dkoleary(a)olearycomputers.com (w) 630-904-6098 (c) 630-248-2749 linkedin: http://www.linkedin.com/in/dkoleary resume: http://www.olearycomputers.com/resume.html

2 3

Recovering a multi-master node after a server failure
by Richard Marshall 22 May '14

22 May '14

Hi, We have a multi master (2-node) cluster running 2.4.23 on CentOS 6. We're effectively using them as a failover active-standby pair. The 'Master' node failed last night and we failed over to the standby (they're behind a load balancer). I am now trying to bring the old 'Master' back online but it has become apparent there was a misconfiguration in the server id config. We did have 'Master' = serverid 1 and 'slave' = serverid 2 - i.e. it was missing the servers URI. I have now fixed this, but we have around 500 objects on the old master reporting " changed by peer, ignored in the sync log. The old master will get up to the latest CSN number after I restart it, but then get stuck with these " changed by peer, ignored" errors. My question is, how do I get past this? Is it possible to remove the objects and if so how (I don't want to delete them totally, just remove the conflict). Or, do I need to rebuild the 'old' master server database? If so, is the process to stop slapd, remove the content of the database and accesslog directories. Create an ldif export on the live server, slapadd that file back on to the 'old' master, start it and then allow it to replicate any new changes from it's partner? If this is the only way to do it, is there anything I need to look out for? If not this, then what do I do? I've looked but can't find any guidelines in how to recover a failed node. Any help appreciated! Thanks, Rich

2 1

Advice for repairing lost db log file
by jupiter 22 May '14

22 May '14

Hi, We are running ldap server on CentOS 6.4. We've just found that slapd stopped as the DB log file (log.0000000001) is being removed and lost (someone may delete it inadvertently), now the slapd cannot be started. Although we have a backup days ago, I am not sure if it will work to copy the outdated backup DB log file to the ldap server. Appreciate any advice of repairing it. Thank you. Kind regards, jupiter

1 0

ldapsearch hidden option "-T"
by Auteria W. Winzer Jr. 21 May '14

21 May '14

Is the "-T" option for ldapsearch available in 2.4.39, or has it been permanently removed? Regards, Auteria Winzer Jr.

7 13

RE: pplolicy lockout grace time? - alternatives
by Chris Jacobs 21 May '14

21 May '14

> First of all, password lockout itself is a dumb idea, and we only implement it > because it's part of the original ppolicy spec. The ppolicy spec is pathetically > bad though. What methods aren't dumb ideas that accomplish account unavailability on N password failures? > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

2 3

Datatype mapping for openldap
by Sankar P 21 May '14

21 May '14

Hi, I saw some example code on MSDN which I tried to compile against openldap on Linux and got some errors. The C code that I tried to compile was: http://msdn.microsoft.com/en-us/library/aa367017(v=vs.85).aspx The errors were related to the undefined nature of types such as: DWORD, PCHAR, BOOL, TRUE, FALSE and functions such as _snprintf_s etc. While I could define these types myself, I wanted to check if there are any standard header files that do these type mappings already. Doing a `rpm -ql openldap2-devel | grep h$ | xargs grep DWORD` did not return anything and so I am feeling that no such standard type-mapping already exists. But I wanted to confirm and to know what is the best practice to follow here. Thanks. -- Sankar P http://psankar.blogspot.com

2 1

pplolicy lockout grace time?
by Emmanuel Dreyfus 21 May '14

21 May '14

Hello We ran into the following problem: someone changes its password, but has a few devices with the old password recorderd. Before the user has time to update stored passwords, an buggy-client hammers servers with requests using the old password, and get the account locked by slapo-ppolicy. Perhaps there could be a setting in pwdPolicy or in slapd.conf so that there is a grace time after a password reset? For instance, the admin could configure that slapo-ppolicy should not lock a user if password has been changed less than X seconds ago. Opinions? -- Emmanuel Dreyfus manu(a)netbsd.org

2 1

DIT for an academic institution
by Shali 9846303531 20 May '14

20 May '14

Dear All, I am new to these LDAP concepts , i have prepared a DIT for our organization with two academic institutions with each institution having different branches of study and also there is staff and students . i have attached the DIT , if am going through a wrong way kindly guide me. -- Thanks & Regards Shali.K.R Server Administrator

4 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical