openldap-technical

openldap-technical@openldap.org

20 participants
9802 discussions

OpenLDAP-2.4.23 on SUSE 11
by Mulligan, Scott 19 May '14

19 May '14

I am running openldap-2.4.23 on SUSE 10 with no problems. After upgrading to SUSE 11, I cannot start slapd. I get an error that it can't find libltdl.so.3. I noticed that libltdl.so.7 is in /usr/lib64. My question is: Will openldap-2.4.23 work with libltdl.so.7 or do I need to upgrade openldap to run on SUSE 11? Can I install a version of libltdl.so.3 on SUSE 11 and get it to work? Are there any other options? Thanks for any suggestions. I haven't been able to find anything about this for days.

2 1

Host Based OpenLDAP Authentication On Mac OS X Mountain Lion
by Amit More 19 May '14

19 May '14

Hello All, I'm sorry if this is the wrong group to post such a question. I have openldap (slapd version 2.4.31-1+nmu2ubuntu8) running on Ubuntu Server 14.04. The 'hostObject' objectClass is added in the OpenLDAP directory. The 'host' attribute is added under all ldap users, which allows users to access just those particular hosts. Apple schema has been added as well. I have a ubuntu client that authenticates users against the ldap server. The ubuntu client is configured to perform host-based authentication via pam modules. Only users that have access to the Ubuntu client can login, and others are denied access. I also have a Mac OS X Mountain Lion (10.8.5) client that authenticates users against the same openldap server. All network users can login through the login window. I would like to restrict access to the Mountain Lion client based on hosts, as I've it on the Ubuntu client. I tried to search for documentation on this, but didn't find any good one. Most of the documentation suggest that network user access be controlled on the Mountain Lion client. I'd really like to have that control on ldap server and not on client. Also, restricting network user access using 'Users & Groups' settings in System Preferences fails. All ldap users are blocked from login. I have successfully tested host-based authentication on a Ubuntu Server 10.04 client that is connected to the same ldap server. So, I know host based authentication works. I would really appreciate if anyone could shed some light on this, or point me to a document that talks about host-based authentication on Mac OS X Mountain Lion client. Thanks, Amit

1 0

virtual lists
by Laurent Schweizer 19 May '14

19 May '14

Hello, I have a ldap client requesting virtual lists and I get an error with openldap (critical extension is not recognized) , ldap exchange are bellow. Any idea how to enable virtual list ? BR Laurent REQUEST Lightweight Directory Access Protocol LDAPMessage searchRequest(2) "dc=peoplefone, dc=com" wholeSubtree messageID: 2 protocolOp: searchRequest (3) searchRequest [Response In: 1785] controls: 2 items Control controlType: 1.2.840.113556.1.4.473 (sortKeyList) criticality: True SortKeyList: 1 item SortKeyList item attributeType: cn Control controlType: 2.16.840.1.113730.3.4.9 (LDAP_CONTROL_VLVREQUEST VLV) criticality: True controlValue: 300e020100020100a006020101020100 REPONSE Lightweight Directory Access Protocol LDAPMessage searchResDone(2) unavailableCriticalExtension (critical extension is not recognized) [0 results] messageID: 2 protocolOp: searchResDone (5) searchResDone

2 2

Close sometime takes a long time
by Venkat Murty 19 May '14

19 May '14

Why does close sometime take a long time? mdb_env_close (in sync7320902242508427276.so) + 69 [0x112e37d35] mdb_env_close0 (in sync7320902242508427276.so) + 248 [0x112e37948] close (in libsystem_kernel.dylib) + 10 [0x7fff8bf900c2] Usually, happens when I have killed the process the last time. System: Mac OS X Thanks, Venkat Murty

3 8

slapcat -c problem
by David Spurek 19 May '14

19 May '14

Hi, slapcat -c doesn't work as I expect in one case. It should ignore errors. I have following slapd.conf with 2 suffixies, only the second one (dc=my-domain,dc=com) is filled with data: cat slapd.conf include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args database bdb suffix dc=example,dc=com rootdn "cn=Manager,dc=example,dc=com" rootpw x directory /var/lib/ldap/ database bdb suffix dc=my-domain,dc=com rootdn "cn=Manager,dc=my-domain,dc=com" rootpw x directory /tmp/tmp.lfFaOlWyes/ldap-test-ldap2 [test]slapcat 537223f1 bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap/: (2). Expect poor performance for suffix "dc=example,dc=com". 537223f1 bdb_db_open: database "dc=example,dc=com": db_open(/var/lib/ldap//id2entry.bdb) failed: No such file or directory (2). 537223f1 backend_startup_one (type=bdb, suffix="dc=example,dc=com"): bi_db_open failed! (2) slap_startup failed 'slapcat -c' gives me the same output. I expect that it will ignore errors with the first database and dumps the database for second suffix. Should slapcat -c skip error in this case? Tested with openldap-2.4.39 -- David Spurek

2 1

Multiple ou entries are added
by David Spurek 19 May '14

19 May '14

Hi, If I add following ldif with slapadd(attribute 'ou' and 'ou' in dn: are different): dn: ou=testou.auto,dc=my-domain,dc=com ou: testou.misc objectClass: top objectClass: organizationalUnit Slapadd doesn't evalute it as an error in ldif but it adds 'ou' from dn as another attribute. Added entry then looks like: # testou.auto, my-domain.com dn: ou=testou.auto,dc=my-domain,dc=com ou: testou.misc ou: testou.auto objectClass: top objectClass: organizationalUnit Is this expected behavior or a bug? Tested with openldap-2.4.39 -- David Spurek

2 1

slapadd -s doesn't add structuralObjectClass attribute
by David Spurek 19 May '14

19 May '14

Hi, If I add ldap entry with 'slapadd -s' then added entry doesn't contain structuralObjectClass attribute. Is this expected behavior? Tested with openldap-2.4.39 -- David Spurek

1 0

Encryption storage mechanism SHA256 in OpenLDAP
by bris chik 19 May '14

19 May '14

Hi All We are using OpenLDAP 2.4.38 windows version as user store for our application. I need to configure encryption storage mechanish as SHA256 in openLDAP. I tried with changing #password-hash {CLEARTEXT} password-hash {SHA256} But it is not working. I mean after making this change password got saved in OpenLDAP as SHA256 but after that when I am authenticating using pwd through JNDI it cannot match with the stored one and it says incorrect credentials. FYI - I am just taking the plain text pwd as user is providing in login page and passing to openLDAP. My understanding is OpenLDAP will take the plaintext pwd and encrypt it to SHA256 and compare with its store. Please let me know if my understanding is wrong or anything extra I have to do here. I got one link for doing this in linux version but didn't get anything for windows version. http://www.openldap.org/devel//cvsweb.cgi/~checkout~/contrib/slapd-modules/…<http://www.openldap.org/devel/cvsweb.cgi/~checkout~/contrib/slapd-modules/p…> Can anyone please help me on this?

1 0

Weird DNS round-robin issue
by Dennis Leeuw 18 May '14

18 May '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, I hope I am on the right list for the problem I am experiencing. We have two subnets 192.168.196. 192.168.222. Our main LDAP servers run in 192.168.196. and are load-balanced by round-robin DNS. The 192.168.196. network is exhausted, so we added a new LDAP slave to 192.168.222. and added the IP address to the round-robin pool. But it seems that it is only used by other servers in the 192.168.222 network and not by servers in the 192.168.196. network This setup has now been running for 6 days, with nscd.conf: enable-cache hosts yes positive-time-to-live hosts 3600 negative-time-to-live hosts 20 suggested-size hosts 211 check-files hosts yes persistent hosts yes shared hosts yes max-db-size hosts 33554432 and nslcd.conf: uid nslcd gid ldap uri ldap://ldap.div.ourdomain.nl/ base dc=div,dc=ourdomain,dc=nl ssl no tls_cacertdir /etc/openldap/cacerts The LDAP server in the 192.168.222 range serves only 33 connections all from the 192.168.222 range, and the 2 hosts in the 192.168.196 range serve 599 and 706 connections. The last 2 servers do serve the 143.121.222. network also. So might there be some caching issue? $ getent ahost ldap.div.ourdomain.nl 192.168.196.190 STREAM ldap.div.ourdomain.nl 192.168.196.190 DGRAM 192.168.196.190 RAW 192.168.196.151 STREAM 192.168.196.151 DGRAM 192.168.196.151 RAW 192.168.222.179 STREAM 192.168.222.179 DGRAM 192.168.222.179 RAW Is this the right list for this question? And if so can someone help me understand what is going on? With kind regards, Dennis Leeuw - -- ICT Medewerker Divisie Biomedische Genetica UMC Utrecht Heidelberglaan 100 STR2.126 3584 CX Utrecht The Netherlands 06 27744048 intern: 64048 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTAyjwAAoJEMVYYpdbQscouGsH/3yXjh6zmLMDRaks18qe+yH7 oUrdatkENF7+WyxLz7ZzNL69gXyEwTANGGf9y7CYuqNu47PDs3SvNOM1/kgjy7pr CSN1t9acVb9i67JgOV2ed5fMHlOzOR+sevNKjsdEdKVXrYvcXnevLOD0KHhGlXeq Ips0Uqk8cusDXQZSUPab0aQNhWawyT1Tf4SQVAJbJ3OYEiFpHyPJXos2F4DIpYPJ 9FLn/dqV8sUNc9kaOHRjwcVYYAVyey9vX33xbYKr4pXKLd/ujaArBtwE1tyKvR2G JPz6Gw5sYK5JLjkmr1uzPAze46heiVFY6U1Vv7aMJ4ujuabBiU11Us2k4XuotPI= =UxBr -----END PGP SIGNATURE----- ------------------------------------------------------------------------------ De informatie opgenomen in dit bericht kan vertrouwelijk zijn en is uitsluitend bestemd voor de geadresseerde. Indien u dit bericht onterecht ontvangt, wordt u verzocht de inhoud niet te gebruiken en de afzender direct te informeren door het bericht te retourneren. Het Universitair Medisch Centrum Utrecht is een publiekrechtelijke rechtspersoon in de zin van de W.H.W. (Wet Hoger Onderwijs en Wetenschappelijk Onderzoek) en staat geregistreerd bij de Kamer van Koophandel voor Midden-Nederland onder nr. 30244197. Denk s.v.p aan het milieu voor u deze e-mail afdrukt. ------------------------------------------------------------------------------ This message may contain confidential information and is intended exclusively for the addressee. If you receive this message unintentionally, please do not use the contents but notify the sender immediately by return e-mail. University Medical Center Utrecht is a legal person by public law and is registered at the Chamber of Commerce for Midden-Nederland under no. 30244197. Please consider the environment before printing this e-mail.

4 9

Re: Need Schema for aci attribute
by neel 17 May '14

17 May '14

> neel wrote: > > I am using HPCC and I am integrating it with openldap. In that when I > start > > one component I.e. mydali server. It throws this error. > > I don't know HPCC. Is it this one? > > https://track.hpccsystems.com/browse/HPCC-7999 > > Ciao, Michael. > > Yep, you are correct. Regards Neelesh

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical