openldap-technical

openldap-technical@openldap.org

3 participants
9990 discussions

Problem: LDAP installation without internet
by Patrick Pat 23 Sep '14

23 Sep '14

Hi, I would like all LDAP installation procedure without internet in linux (ubuntu (9.10 or other), Debian, ...), but by its compressed file namely: openldap-2.4.8.tgz or openldap-2.4.7.tgz or openldap-2.4.9.tgz or openldap-2.0-beta.tgz ... And any configuration environment variables. best regards !

2 1

for aia and cdp; crl and ca publishing in ldap
by lux-integ 23 Sep '14

23 Sep '14

Greetings, I am learning to use openldap. I want to publish CA certificates and crls ( in der format ) in an ldap database. I came accross this link http://www.tldp.org/HOWTO/archived/LDAP-Implementation-HOWTO/certificates.h… ) it relates to publishing 1 certificate. However, I would like to be able to use one entry in the database to later access 2 objects by URL entry (i) so called AuthorityInformationAccess (CA certificate location ) and (ii) CDP (crl distribution point. So I have 2 questions: QUESTION1 ========= I would like to know if I can publish 2 certififates and in the ldif have someting such as :- #----------- dn: cn=certs,dc=example,dc=com ObjectClass: Top ObjectClass: ApplicationProcess ObjectClass: SimpleSecurityObject CertificateRevocationList::-------someBinaryFile CACertificate::-------------------someBinaryFile cn: certs UserPassword: cert-password QUESTION2 ========= if I have the files binary File_crl and CAcertificate can I replace lines 5 and 6 above like this?: CertificateRevocationList;binary: < /path/to/someBinaryFile_File_crl CACertificate;binary: < /path/to/someBinaryFile_CACertificate and if so which is the recommended file insertion or use of pointer? Advice on the above or better methods to proceed will be gratefully received. thanks in advance luxInteg

1 0

Hi, I need help regarding customize schema regarding OpenLDAD 2.4.39 configuration.
by Abhishek koserwal 21 Sep '14

21 Sep '14

Hi, I need some reference material regarding "How to configure customize schema" in OpenLdap2.4.x. I have some schema files of version 2.3<, when slapd.conf were used. I am want to import those schema into new Openldap.2.4.39 . I have gone through Admin guide tried some methods but, I didn't get much help from it. Kindly help me or whom should I contact or any specific materials. Thank You, Abhishek koserwal,

4 4

Updates to OIDs
by Brendan Kearney 18 Sep '14

18 Sep '14

list, i am wondering what the right way is to introduce new OIDs, or request that new OIDs be introduced, to existing schemas. the ipNetwork class could benefit with a couple new optional attributes. the ipNetworkVLAN (only a suggested name) can be used to indicate the VLAN associated with an ipNetworkNumber. due to the increasing use of VLANs, the datapoint being represented in LDAP makes sense to me. another seemingly logical OID would be ipNetCIDR (suggestion only) which would be similar to the ipNetmaskNumber, but would be the short form notation. thank you, brendan kearney

3 4

Trying to perform mirror sync , but getting - TLS: error: the certificate '/etc/openldap/certs/xxx.crt' could not be found in the database - error -12285:Unable to find the certificate or key necessary for authentication.
by Sterling Sahaydak 18 Sep '14

18 Sep '14

I've recently updated both my openldap servers to 2.4.39 version and everything seems to be working EXCEPT the mirror synchronization which was the issue I had previously with 2.4.23 Running on CentOS 6.5 Setup - Server1(provider): ldap-east.xxxxx.net Server2(consumer): ldap-west.xxxxx.net Not using self signed certs. Instead have a SAN(Subject Alternative Name)cert from DigiCert with 4 hostnames: ldap.xxxxx.net ldap-1.xxxxx.net ldap-2.xxxxx.net ldap-alt.xxxxx.net I'm using slapd.conf vs cn=config. The details: [root@ldap-east certs]# slapd -d sync 541b16ed @(#) $OpenLDAP: slapd 2.4.39 (Sep 16 2014 19:42:16) $ root@admin.pcoral.net:/root/rpmbuild/BUILD/openldap-2.4.39/openldap-2.4.39/servers/slapd 541b16ed /etc/openldap/slapd.conf: line 165: warning, destination attributeType 'sAMAccountName' is not defined in schema 541b16ed PROXIED attributeDescription "SAMACCOUNTNAME" inserted. 541b16ed /etc/openldap/slapd.conf: line 215: rootdn is always granted unlimited privileges. 541b16ed bdb_monitor_db_open: monitoring disabled; configure monitor database to enable 541b16ed slapd starting TLS: error: the certificate '/etc/openldap/certs/ldap_xxxxx_net.crt' could not be found in the database - error -12285:Unable to find the certificate or key necessary for authentication.. TLS: certificate '/etc/openldap/certs/ldap_xxxxx_net.crt' successfully loaded from PEM file. TLS: no unlocked certificate for certificate 'CN=ldap.xxxxx.net,O="xxxxxx, INC.",L=Alviso,ST=California,C=US'. 541b16ed do_syncrep2: rid=001 LDAP_RES_INTERMEDIATE - REFRESH_DELETE *** I wonder if there is something about SAN certs where ldap is having issues ? *** Since it is a signed CA cert in a mirror sync setup do I need to set it up in the local CA(using certutil) and add it? (didn't have to for non-sync use) *** Unclear of 'not found in database' - which one? I've tried adding it using certutil in various permutations of setting adding the cert to the local CA database with all the various SAN names as different nick names *** I've also setup symlinks in /etc/openldap/certs pointing from the hashes -> certs - but all of these with the exact same output as above. >From the debug log: Sep 18 13:39:30 ldap-east slapd[18966]: @(#) $OpenLDAP: slapd 2.4.39 (Sep 16 2014 19:42:16) $#012#011root@admin.xxxxx.net:/root/rpmbuild/BUILD/openldap-2.4.39/openldap-2.4.39/servers/slapd Sep 18 13:39:30 ldap-east slapd[18966]: /etc/openldap/slapd.conf: line 165: warning, destination attributeType 'sAMAccountName' is not defined in schema Sep 18 13:39:30 ldap-east slapd[18966]: PROXIED attributeDescription "SAMACCOUNTNAME" inserted. Sep 18 13:39:30 ldap-east slapd[18966]: /etc/openldap/slapd.conf: line 215: rootdn is always granted unlimited privileges. Sep 18 13:39:30 ldap-east slapd[18966]: >>> dnNormalize: <cn=Subschema> Sep 18 13:39:30 ldap-east slapd[18966]: <<< dnNormalize: <cn=subschema> Sep 18 13:39:30 ldap-east slapd[18966]: matching_rule_use_init Sep 18 13:39:30 ldap-east slapd[18966]: 1.2.840.113556.1.4.804 (integerBitOrMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 1.2.840.113556.1.4.804 NAME 'integerBitOrMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcListenerThreads $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcDbMaxReaders $ olcDbMaxSize $ olcSpSessionlog $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ olcChainMaxReferralDepth $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber $ sudoOrder ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 1.2.840.113556.1.4.803 (integerBitAndMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 1.2.840.113556.1.4.803 NAME 'integerBitAndMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcListenerThreads $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcDbMaxReaders $ olcDbMaxSize $ olcSpSessionlog $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ olcChainMaxReferralDepth $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber $ sudoOrder ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 1.3.6.1.4.1.1466.109.114.2 (caseIgnoreIA5Match): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 1.3.6.1.4.1.1466.109.114.2 NAME 'caseIgnoreIA5Match' APPLIES ( altServer $ olcDbConfig $ c $ mail $ dc $ associatedDomain $ email $ aRecord $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMailbox $ gecos $ homeDirectory $ loginShell $ memberUid $ memberNisNetgroup $ ipHostNumber $ ipNetworkNumber $ ipNetmaskNumber $ macAddress $ bootFile $ nisMapEntry $ sudoUser $ sudoHost $ sudoCommand $ sudoRunAs $ sudoOption $ sudoRunAsUser $ sudoRunAsGroup ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 1.3.6.1.4.1.1466.109.114.1 (caseExactIA5Match): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 1.3.6.1.4.1.1466.109.114.1 NAME 'caseExactIA5Match' APPLIES ( altServer $ olcDbConfig $ c $ mail $ dc $ associatedDomain $ email $ aRecord $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMailbox $ gecos $ homeDirectory $ loginShell $ memberUid $ memberNisNetgroup $ ipHostNumber $ ipNetworkNumber $ ipNetmaskNumber $ macAddress $ bootFile $ nisMapEntry $ sudoUser $ sudoHost $ sudoCommand $ sudoRunAs $ sudoOption $ sudoRunAsUser $ sudoRunAsGroup ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.39 (certificateListMatch): Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.38 (certificateListExactMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.38 NAME 'certificateListExactMatch' APPLIES ( authorityRevocationList $ certificateRevocationList $ deltaRevocationList ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.35 (certificateMatch): Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.34 (certificateExactMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.34 NAME 'certificateExactMatch' APPLIES ( userCertificate $ cACertificate ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.30 (objectIdentifierFirstComponentMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.30 NAME 'objectIdentifierFirstComponentMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ ldapSyntaxes $ supportedApplicationContext ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.29 (integerFirstComponentMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.29 NAME 'integerFirstComponentMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcListenerThreads $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcDbMaxReaders $ olcDbMaxSize $ olcSpSessionlog $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ olcChainMaxReferralDepth $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber $ sudoOrder ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.28 (generalizedTimeOrderingMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.28 NAME 'generalizedTimeOrderingMatch' APPLIES ( createTimestamp $ modifyTimestamp $ sudoNotBefore $ sudoNotAfter ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.27 (generalizedTimeMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.27 NAME 'generalizedTimeMatch' APPLIES ( createTimestamp $ modifyTimestamp $ sudoNotBefore $ sudoNotAfter ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.24 (protocolInformationMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.24 NAME 'protocolInformationMatch' APPLIES protocolInformation ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.23 (uniqueMemberMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.23 NAME 'uniqueMemberMatch' APPLIES uniqueMember ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.22 (presentationAddressMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.22 NAME 'presentationAddressMatch' APPLIES presentationAddress ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.20 (telephoneNumberMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.20 NAME 'telephoneNumberMatch' APPLIES ( telephoneNumber $ homePhone $ mobile $ pager ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.18 (octetStringOrderingMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.18 NAME 'octetStringOrderingMatch' APPLIES ( userPassword $ olcDbCryptKey ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.17 (octetStringMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.17 NAME 'octetStringMatch' APPLIES ( userPassword $ olcDbCryptKey ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.16 (bitStringMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.16 NAME 'bitStringMatch' APPLIES x500UniqueIdentifier ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.15 (integerOrderingMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.15 NAME 'integerOrderingMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcListenerThreads $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcDbMaxReaders $ olcDbMaxSize $ olcSpSessionlog $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ olcChainMaxReferralDepth $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber $ sudoOrder ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.14 (integerMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.14 NAME 'integerMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcListenerThreads $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcDbMaxReaders $ olcDbMaxSize $ olcSpSessionlog $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ olcChainMaxReferralDepth $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber $ sudoOrder ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.13 (booleanMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.13 NAME 'booleanMatch' APPLIES ( hasSubordinates $ olcAddContentAcl $ olcGentleHUP $ olcHidden $ olcLastMod $ olcMirrorMode $ olcMonitoring $ olcReadOnly $ olcReverseLookup $ olcSyncUseSubentry $ olcDbChecksum $ olcDbNoSync $ olcDbDirtyRead $ olcDbLinearIndex $ olcAccessLogSuccess $ olcRwmNormalizeMapped $ olcRwmDropUnrequested $ olcSpNoPresent $ olcSpReloadHint $ olcDbRebindAsUser $ olcDbChaseReferrals $ olcDbProxyWhoAmI $ olcDbSingleConn $ olcDbUseTemporaryConn $ olcDbSessionTrackingRequest $ olcDbNoRefs $ olcDbNoUndefFilter $ olcChainCacheURI $ olcChainReturnError ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.11 (caseIgnoreListMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.11 NAME 'caseIgnoreListMatch' APPLIES ( postalAddress $ registeredAddress $ homePostalAddress ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.9 (numericStringOrderingMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.9 NAME 'numericStringOrderingMatch' APPLIES ( x121Address $ internationaliSDNNumber ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.8 (numericStringMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.8 NAME 'numericStringMatch' APPLIES ( x121Address $ internationaliSDNNumber ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.7 (caseExactSubstringsMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.7 NAME 'caseExactSubstringsMatch' APPLIES ( serialNumber $ c $ telephoneNumber $ destinationIndicator $ dnQualifier $ homePhone $ mobile $ pager ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.6 (caseExactOrderingMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.6 NAME 'caseExactOrderingMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcExtraAttrs $ olcInclude $ olcLdapSyntaxes $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLimit $ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTCPBuffer $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSCRLFile $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSProtocolMin $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbCryptFile $ olcDbPageSize $ olcDbIndex $ olcDbLockDetect $ olcDbMode $ olcDbEnvFlags $ olcAccessLogOps $ olcAccessLogPurge $ olcAccessLogOld $ olcAccessLogOldAttr $ olcAccessLogBase $ olcRwmRewrite $ olcRwmTFSupport $ olcRwmMap $ olcSpCheckpoint $ olcDbURI $ olcDbStartTLS $ olcDbACLPasswd $ olcDbACLBind $ olcDbIDAssertPasswd $ olcDbIDAssertBind $ olcDbIDAssertMode $ olcDbIDAssertAuthzFrom $ olcDbTFSupport $ olcDbTimeout $ olcDbIdleTimeout $ olcDbConnTtl $ olcDbNetworkTimeout $ olcDbCancel $ olcDbQuarantine $ olcDbOnErr $ olcDbIDAssertPassThru $ olcDbKeepalive $ olcChainingBehavior $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOffi Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.5 (caseExactMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.5 NAME 'caseExactMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcExtraAttrs $ olcInclude $ olcLdapSyntaxes $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLimit $ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTCPBuffer $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSCRLFile $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSProtocolMin $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbCryptFile $ olcDbPageSize $ olcDbIndex $ olcDbLockDetect $ olcDbMode $ olcDbEnvFlags $ olcAccessLogOps $ olcAccessLogPurge $ olcAccessLogOld $ olcAccessLogOldAttr $ olcAccessLogBase $ olcRwmRewrite $ olcRwmTFSupport $ olcRwmMap $ olcSpCheckpoint $ olcDbURI $ olcDbStartTLS $ olcDbACLPasswd $ olcDbACLBind $ olcDbIDAssertPasswd $ olcDbIDAssertBind $ olcDbIDAssertMode $ olcDbIDAssertAuthzFrom $ olcDbTFSupport $ olcDbTimeout $ olcDbIdleTimeout $ olcDbConnTtl $ olcDbNetworkTimeout $ olcDbCancel $ olcDbQuarantine $ olcDbOnErr $ olcDbIDAssertPassThru $ olcDbKeepalive $ olcChainingBehavior $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName $ Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.4 (caseIgnoreSubstringsMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.4 NAME 'caseIgnoreSubstringsMatch' APPLIES ( serialNumber $ c $ telephoneNumber $ destinationIndicator $ dnQualifier $ homePhone $ mobile $ pager ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.3 (caseIgnoreOrderingMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.3 NAME 'caseIgnoreOrderingMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcExtraAttrs $ olcInclude $ olcLdapSyntaxes $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLimit $ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTCPBuffer $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSCRLFile $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSProtocolMin $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbCryptFile $ olcDbPageSize $ olcDbIndex $ olcDbLockDetect $ olcDbMode $ olcDbEnvFlags $ olcAccessLogOps $ olcAccessLogPurge $ olcAccessLogOld $ olcAccessLogOldAttr $ olcAccessLogBase $ olcRwmRewrite $ olcRwmTFSupport $ olcRwmMap $ olcSpCheckpoint $ olcDbURI $ olcDbStartTLS $ olcDbACLPasswd $ olcDbACLBind $ olcDbIDAssertPasswd $ olcDbIDAssertBind $ olcDbIDAssertMode $ olcDbIDAssertAuthzFrom $ olcDbTFSupport $ olcDbTimeout $ olcDbIdleTimeout $ olcDbConnTtl $ olcDbNetworkTimeout $ olcDbCancel $ olcDbQuarantine $ olcDbOnErr $ olcDbIDAssertPassThru $ olcDbKeepalive $ olcChainingBehavior $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOff Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.2 (caseIgnoreMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.2 NAME 'caseIgnoreMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcExtraAttrs $ olcInclude $ olcLdapSyntaxes $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLimit $ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTCPBuffer $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSCRLFile $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSProtocolMin $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbCryptFile $ olcDbPageSize $ olcDbIndex $ olcDbLockDetect $ olcDbMode $ olcDbEnvFlags $ olcAccessLogOps $ olcAccessLogPurge $ olcAccessLogOld $ olcAccessLogOldAttr $ olcAccessLogBase $ olcRwmRewrite $ olcRwmTFSupport $ olcRwmMap $ olcSpCheckpoint $ olcDbURI $ olcDbStartTLS $ olcDbACLPasswd $ olcDbACLBind $ olcDbIDAssertPasswd $ olcDbIDAssertBind $ olcDbIDAssertMode $ olcDbIDAssertAuthzFrom $ olcDbTFSupport $ olcDbTimeout $ olcDbIdleTimeout $ olcDbConnTtl $ olcDbNetworkTimeout $ olcDbCancel $ olcDbQuarantine $ olcDbOnErr $ olcDbIDAssertPassThru $ olcDbKeepalive $ olcChainingBehavior $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName Sep 18 13:39:30 ldap-east slapd[18966]: 1.2.36.79672281.1.13.3 (rdnMatch): Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.1 (distinguishedNameMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.1 NAME 'distinguishedNameMatch' APPLIES ( creatorsName $ modifiersName $ subschemaSubentry $ entryDN $ namingContexts $ aliasedObjectName $ dynamicSubtrees $ distinguishedName $ seeAlso $ olcDefaultSearchBase $ olcRootDN $ olcSchemaDN $ olcSuffix $ olcUpdateDN $ olcAccessLogDB $ olcDbACLAuthcDn $ olcDbIDAssertAuthcDn $ member $ owner $ roleOccupant $ manager $ documentAuthor $ secretary $ associatedName $ dITRedirect ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.0 (objectIdentifierMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.0 NAME 'objectIdentifierMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ supportedApplicationContext ) ) Sep 18 13:39:30 ldap-east slapd[18966]: slapd startup: initiated. Sep 18 13:39:30 ldap-east slapd[18966]: backend_startup_one: starting "cn=config" Sep 18 13:39:30 ldap-east slapd[18966]: config_back_db_open Sep 18 13:39:30 ldap-east slapd[18966]: config_back_db_open: line 0: warning: cannot assess the validity of the ACL scope within backend naming context Sep 18 13:39:30 ldap-east slapd[18966]: config_back_db_open: No explicit ACL for back-config configured. Using hardcoded default Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "cn=config" Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "cn=module{0}" Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "cn=schema" Sep 18 13:39:30 ldap-east slapd[18966]: >>> dnNormalize: <cn={0}core> Sep 18 13:39:30 ldap-east slapd[18966]: <<< dnNormalize: <cn={0}core> Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "cn={0}core" Sep 18 13:39:30 ldap-east slapd[18966]: >>> dnNormalize: <cn={1}cosine> Sep 18 13:39:30 ldap-east slapd[18966]: <<< dnNormalize: <cn={1}cosine> Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "cn={1}cosine" Sep 18 13:39:30 ldap-east slapd[18966]: >>> dnNormalize: <cn={2}inetorgperson> Sep 18 13:39:30 ldap-east slapd[18966]: <<< dnNormalize: <cn={2}inetorgperson> Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "cn={2}inetorgperson" Sep 18 13:39:30 ldap-east slapd[18966]: >>> dnNormalize: <cn={3}nis> Sep 18 13:39:30 ldap-east slapd[18966]: <<< dnNormalize: <cn={3}nis> Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "cn={3}nis" Sep 18 13:39:30 ldap-east slapd[18966]: >>> dnNormalize: <cn={4}sudo> Sep 18 13:39:30 ldap-east slapd[18966]: <<< dnNormalize: <cn={4}sudo> Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "cn={4}sudo" Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "olcDatabase={-1}frontend" Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "olcDatabase={0}config" Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "olcDatabase={1}ldap" Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "olcOverlay={0}rwm" Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "olcDatabase={2}bdb" Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "olcOverlay={0}syncprov" Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "olcOverlay={1}glue" Sep 18 13:39:30 ldap-east slapd[18966]: backend_startup_one: starting "ou=Users,ou=xxxxx,dc=ad,dc=xxxxx,dc=net" Sep 18 13:39:30 ldap-east slapd[18966]: ldap_back_db_open: URI=ldap://ad1.xxxxx.net Sep 18 13:39:30 ldap-east slapd[18966]: backend_startup_one: starting "dc=xxxxx,dc=net" Sep 18 13:39:30 ldap-east slapd[18966]: bdb_db_open: "dc=xxxxx,dc=net" Sep 18 13:39:30 ldap-east slapd[18966]: bdb_db_open: database "dc=xxxxx,dc=net": dbenv_open(/var/lib/ldap). Sep 18 13:39:30 ldap-east slapd[18966]: bdb_monitor_db_open: monitoring disabled; configure monitor database to enable Sep 18 13:39:30 ldap-east slapd[18966]: => bdb_entry_get: ndn: "dc=xxxxx,dc=net" Sep 18 13:39:30 ldap-east slapd[18966]: => bdb_entry_get: oc: "(null)", at: "contextCSN" Sep 18 13:39:30 ldap-east slapd[18966]: bdb_dn2entry("dc=xxxxx,dc=net") Sep 18 13:39:30 ldap-east slapd[18966]: => bdb_dn2id("dc=xxxxx,dc=net") Sep 18 13:39:30 ldap-east slapd[18966]: <= bdb_dn2id: got id=0x7 Sep 18 13:39:30 ldap-east slapd[18966]: entry_decode: "dc=xxxxx,dc=net" Sep 18 13:39:30 ldap-east slapd[18966]: <= entry_decode(dc=xxxxx,dc=net) Sep 18 13:39:30 ldap-east slapd[18966]: => bdb_entry_get: found entry: "dc=xxxxx,dc=net" Sep 18 13:39:30 ldap-east slapd[18966]: bdb_entry_get: rc=0 Sep 18 13:39:30 ldap-east slapd[18966]: slapd starting Sep 18 13:39:30 ldap-east slapd[18966]: daemon: added 4r listener=(nil) Sep 18 13:39:30 ldap-east slapd[18966]: daemon: added 7r listener=0x7f37cb13f7c0 Sep 18 13:39:30 ldap-east slapd[18966]: daemon: added 8r listener=0x7f37cb13f8a0 Sep 18 13:39:30 ldap-east slapd[18966]: daemon: epoll: listen=7 active_threads=0 tvp=zero Sep 18 13:39:30 ldap-east slapd[18966]: daemon: epoll: listen=8 active_threads=0 tvp=zero Sep 18 13:39:30 ldap-east slapd[18966]: daemon: activity on 1 descriptor Sep 18 13:39:30 ldap-east slapd[18966]: daemon: activity on: Sep 18 13:39:30 ldap-east slapd[18966]: Sep 18 13:39:30 ldap-east slapd[18966]: daemon: epoll: listen=7 active_threads=0 tvp=zero Sep 18 13:39:30 ldap-east slapd[18966]: daemon: epoll: listen=8 active_threads=0 tvp=zero Sep 18 13:39:30 ldap-east slapd[18966]: =>do_syncrepl rid=001 Sep 18 13:39:30 ldap-east slapd[18966]: => bdb_entry_get: ndn: "dc=xxxxx,dc=net" Sep 18 13:39:30 ldap-east slapd[18966]: => bdb_entry_get: oc: "(null)", at: "contextCSN" Sep 18 13:39:30 ldap-east slapd[18966]: bdb_dn2entry("dc=xxxxx,dc=net") Sep 18 13:39:30 ldap-east slapd[18966]: => bdb_entry_get: found entry: "dc=xxxxx,dc=net" Sep 18 13:39:30 ldap-east slapd[18966]: bdb_entry_get: rc=0 Sep 18 13:39:30 ldap-east slapd[18966]: => access_allowed: result not in cache (contextCSN) Sep 18 13:39:30 ldap-east slapd[18966]: => access_allowed: read access to "dc=xxxxx,dc=net" "contextCSN" requested Sep 18 13:39:30 ldap-east slapd[18966]: <= root access granted Sep 18 13:39:30 ldap-east slapd[18966]: => access_allowed: read access granted by manage(=mwrscxd) Sep 18 13:39:30 ldap-east slapd[18966]: => access_allowed: result was in cache (contextCSN) Sep 18 13:39:30 ldap-east slapd[18966]: => access_allowed: result was in cache (contextCSN) Sep 18 13:39:30 ldap-east slapd[18966]: =>do_syncrep2 rid=001 Sep 18 13:39:30 ldap-east slapd[18966]: do_syncrep2: rid=001 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Sep 18 13:39:30 ldap-east slapd[18966]: daemon: added 13r listener=(nil) Sep 18 13:39:30 ldap-east slapd[18966]: daemon: activity on 1 descriptor Sep 18 13:39:30 ldap-east slapd[18966]: daemon: activity on: Sep 18 13:39:30 ldap-east slapd[18966]: Sep 18 13:39:30 ldap-east slapd[18966]: daemon: epoll: listen=7 active_threads=0 tvp=zero Sep 18 13:39:30 ldap-east slapd[18966]: daemon: epoll: listen=8 active_threads=0 tvp=zero slapd.conf [root@ldap-east openldap]# cat slapd.conf include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/sudo.schema allow bind_v2 TLSCertificateFile /etc/openldap/certs/ldap_xxxxx_net.crt TLSCertificateKeyFile /etc/openldap/certs/ldap_xxxxx_net.key TLSCACertificateFile /etc/openldap/certs/CAcompany.crt pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/lib/openldap modulepath /usr/lib64/openldap moduleload accesslog.la moduleload rwm.la moduleload syncprov.la disallow bind_anon moduleload back_bdb moduleload back_ldap backend bdb moduleload syncprov database ldap suffix "ou=Users,ou=xxxxx,dc=ad,dc=xxxxx,dc=net" uri ldap://ad1.xxxxx.net/ rebind-as-user idassert-bind bindmethod=simple binddn="cn=username,ou=users,ou=xxxxxx,dc=ad,dc=xxxxx,dc=net" credentials="xxxxxxxxx" mode=none idassert-authzFrom "*" chase-referrals yes subordinate overlay rwm rwm-map attribute uid sAMAccountName database bdb suffix "dc=xxxxx,dc=net" checkpoint 1024 15 rootdn "cn=Manager,dc=xxxxx,dc=net" rootpw {SSHA}xxxxxxxxxxx directory /var/lib/ldap access to * by dn.base="cn=TestSync,ou=Roles,dc=xxxxx,dc=net" write by * break # Generic ACL section access to attrs=userPassword,shadowLastChange by dn="cn=Manager,dc=xxxxx,dc=net" write by anonymous auth by self write by * none # Specific ACL section to restrict userPassword to be used for authentication only - 8-15-14 #access to to dn.children="ou=People,dc=xxxxx,dc=net" write # attrs=userPasswrod # by self write # by * auth # by dn.children="ou=Customers,ou=People,dc=xxxxx,dc=net" write # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN,entryUUID eq #LDAP Sync - Master serverID 1 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 #LDAP Sync - Slave syncrepl rid=001 provider=ldaps://ldap-west.xxxxx.net bindmethod=simple binddn="cn=TestSync,ou=Roles,dc=xxxxx,dc=net" credentials=xxxxxxx searchbase="dc=xxxxx,dc=net" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on loglevel -1

2 1

Re: Issues with Ppolicy Overlay and chaining (master/slave)
by Raul Hernandez 18 Sep '14

18 Sep '14

Hi Quanah, I really appreciate your help. I just started some debugging on the master side, and I found out that the root of my issue was permission. I got the following messages on the masters side: 5418a353 conn=1064 op=6 MOD dn="cn=Lisa Hayes,ou=Quality,dc=example,dc=com" 5418a353 conn=1064 op=6 MOD attr=pwdFailureTime 5418a353 conn=1064 op=6 RESULT tag=103 err=50 text= tag=103 err=50 ----> This usually means insufficient access. I look over the my HDB access configuration, and realize that my chaining (cn=syncrepluser,ou=security,dc=example,dc=com) user had "write" permissions on userPassword, pwdFailuretime, pwdChangedTime, pwdHistory, pwdAccountLockedTime attributes and that wasn't enough. I changed the "write" permission to "manage" and everything started working. #----- # Master #----- dn: olcDatabase={1}hdb,cn=config changetype: modify replace: olcAccess olcAccess: {0}to attrs=userPassword,pwdFailuretime,pwdChangedTime,pwdHistory,pwdAccountLockedTime by self write by dn="cn=admin,dc=example,dc=com" write by dn="cn=syncReplUser,ou=Security,dc=example,dc=com" manage by * none Hope this can help others. Thanks a lot for your help!

4 3

Re: Issues with Ppolicy Overlay and chaining (master/slave)
by Raul Hernandez 16 Sep '14

16 Sep '14

OpenLDAP 2.4.39 running on Debian SID I also forgot to post my ppolicy conf for both master and slave: #----- # Master #----- dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulePath: /usr/lib/ldap olcModuleLoad: ppolicy dn: olcOverlay=ppolicy,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: ppolicy olcPPolicyHashCleartext: FALSE olcPPolicyUseLockout: FALSE olcPPolicyDefault: cn=default,ou=policies,dc=bandes,dc=gob,dc=ve #----- # Slave #----- dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulePath: /usr/lib/ldap olcModuleLoad: ppolicy dn: olcOverlay=ppolicy, olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: ppolicy olcPPolicyDefault: cn=default,ou=policies,dc=bandes,dc=gob,dc=ve olcPPolicyHashCleartext: FALSE olcPPolicyUseLockout: FALSE olcPPolicyForwardUpdates: TRUE On Tue, Sep 16, 2014 at 2:30 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, September 16, 2014 3:27 PM -0430 Raul Hernandez < > hernandezr(a)gmail.com> wrote: > > >> >> >> >> Hello! >> >> >> I've been experiencing some issues with ppolicy overlay and chaining. >> I've implemented a simple openldap master and consumer architecture.This >> implementation works fine. I have data from the master, replicated into >> the slave, and all writes sent to the slave (add/edit ous and users), are >> forwarded to the master. >> > > OpenLDAP version? > > --Quanah > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Issues with Ppolicy Overlay and chaining (master/slave)
by Raul Hernandez 16 Sep '14

16 Sep '14

Hello! I've been experiencing some issues with ppolicy overlay and chaining. I've implemented a simple openldap master and consumer architecture.This implementation works fine. I have data from the master, replicated into the slave, and all writes sent to the slave (add/edit ous and users), are forwarded to the master. I've now added to this architecture ppolicy overlay (with olcPPolicyForwardUpdates set to TRUE). When the slave receives a logon failure, it should forward this to the master, so ppolicy overlay can set pwdFailuretime and pwdAccountLockedTime. This is not happening. Neither master nor slave, are setting pwdFailuretime or pwdAccountLockedTime. When debugging the slave, I get the following messages: 541875a7 conn=1010 op=0 BIND dn="cn=Lisa Hayes,ou=Quality,dc=example,dc=com" method=128 541875a7 conn=1010 op=0 ldap_back_retry: retrying URI="ldap://ldapmaster.com" DN="cn=syncrepluser,ou=security,dc=example,dc=com" 541875a7 conn=1010 op=0 RESULT tag=97 err=49 text= 541875a7 conn=1010 op=1 UNBIND 541875a7 conn=1010 fd=21 closed I've been searching the Internet how to solve this issue without any luck. can someone point me to the right direction? Here is my conf for replication and chain in both master and slave: #----- # Master #----- dn: cn=module,cn=config changetype: add objectClass: olcModuleList cn: module olcModulePath: /usr/lib/ldap olcModuleLoad: syncprov dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov #----- # Slave #----- dn: cn=module,cn=config changetype: add objectClass: olcModuleList cn: module olcModulePath: /usr/lib/ldap olcModuleLoad: syncprov olcModuleLoad: back_ldap dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://ldapmaster.com binddn="cn=syncReplUser,ou=Security,dc=example,dc=com" bindmethod=simple credentials=secret searchbase="dc=example,dc=com" type=refreshAndPersist scope=sub retry="5 10 10 +" timeout=1 sizelimit=unlimited schemachecking=on - add: olcUpdateRef olcUpdateRef: ldap://ldapmaster.com dn: olcOverlay=chain,olcDatabase={-1}frontend,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: chain olcChainReturnError: TRUE dn: olcDatabase=ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config changetype: add objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: ldap olcDbURI: ldap://ldapmaster.com olcDbRebindAsUser: TRUE olcDbIDAssertBind: bindmethod=simple binddn="cn=syncReplUser,ou=Security,dc=example,dc=com" credentials=secret mode=self flags=prescriptive,proxy-authz-non-critical Thanks in advanced

2 1

Re: Consumer replication 0 entries fetched - CSN problem?
by Josh Nielsen 16 Sep '14

16 Sep '14

Okay. Thank you for the information Quanah. Regards, Josh On Tue, Sep 16, 2014 at 11:27 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, September 16, 2014 11:38 AM -0500 Josh Nielsen > <jnielsen(a)hudsonalpha.org> wrote: > >> Yes, I used distro packages for Centos 6; and yes, I understand your >> point. I may have the luxury of building openldap from scratch for >> LDAP02, though I don't have the redundancy (the point of this whole >> exercise) that I need to reinstall LDAP01 by building it from scratch. >> That was an unfortunate mistake in hindsight that I stuck with the >> distro package there. I suppose to start over I would have to make a >> new server and slapcat the LDAP01 config? How would I carry over the >> existing DB entries without using replication? I'm still a novice when >> it comes to OLC. >> >> As for the ACL, that was a result of my sloppy email editing. I >> changed the name of the DNs. They actually match in my config. Once I >> proof-of-concept the replication I will create replication-only user >> DNs. >> >> But nothing looks overtly amiss with my CSNs or UUIDs? > > > Hi Josh, > > 2.4.23 is known to have numerous bugs in sync replication. So even once you > have your system configured correctly, there is no guarantee that your data > will be correctly pushed out. I strongly advise you to read over the > CHANGES file for everything fixed since 2.4.23 to the 2.4.40 release: > > <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob_plain;f=CHAN…> > > In addition, there's no requirement that you build OpenLDAP yourself. You > can obtain current OpenLDAP builds from Symas (<https://symas.com/>) or the > LTB project (<http://ltb-project.org/wiki/download#openldap>) for > deployment. > > Regards, > Quanah > > > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

1 0

Consumer replication 0 entries fetched - CSN problem?
by Josh Nielsen 16 Sep '14

16 Sep '14

Hello all, Last year I switched from the slapd.conf to the OLC style config for OpenLDAP and transitionally tested it by making the OLC server a replication slave to the older LDAP server configured with slapd.conf. Now I've disabled replication from that old server and am making the OLC server (LDAP01 - version 2.4.23) the new master and threw up a new VM called LDAP02 (2.4.23) to become the new sync replication slave/consumer. Though I'm using multiple guides of varying detail the simplest setup steps basically followed this article: http://gagravarr.livejournal.com/145679.html. I followed the same steps I thought I did for LDAP01, but despite the fact that I see LDAP02 bind and try to fetch entries for replication nothing is being fetched. The problem description is almost identical to this person's issue: http://www.openldap.org/lists/openldap-software/200911/msg00017.html (with "nentries=0" in the replication log messages, but plenty of entries found with an ldapsearch manually). Though I think my setup situation is different than that person's, and they were exporting using slapcat/slapadd (which I did for converting my existing slapd.conf config to LDAP01 last year, but this time I merely setup LDAP02 from scratch as a cn=config OLC server to begin with), one of the follow-up responses to that email thread said this: "The only correct usage of -w is when you have an LDIF produced by slapcat on a database that was not being used with replication before, and so is missing the contextCSN. But all the other operational attributes (entryUUID and entryCSN in particular) are present and valid." This made me wonder if the problem I'm seeing is because LDAP02 (or LDAP01?) is somehow missing a contextCSN. I am seeing no "cookie" messages associated with replication in my log. Some of my config is below as well as the log messages I am seeing on LDAP01 (edited domain & password). I did notice off-the-bat though that I am missing an "olcDbIndex: entryUUID pres,eq" entry on LDAP02 where I have it on LDAP01. Is that a crucial setting for replication? Lastly, I deleted the database files in /var/lib/ldap/ on LDAP02 and restarted slapd once I had configured "olcSyncRepl" on LDAP02 to ensure that I was starting from scratch. ------- LDAP01's log entry for LDAP02's attempted connection looks like this: Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 fd=359 ACCEPT from IP=192.168.21.60:46198 (IP=0.0.0.0:389) Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 op=0 STARTTLS Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 op=0 RESULT oid= err=0 text= Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 fd=359 TLS established tls_ssf=256 ssf=256 Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 op=1 BIND dn="cn=root,dc=myerslab,dc=haib,dc=org" method=128 Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 op=1 BIND dn="cn=root,dc=myerslab,dc=haib,dc=org" mech=SIMPLE ssf=0 Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 op=1 RESULT tag=97 err=0 text= Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 op=2 SRCH base="dc=myerslab,dc=haib,dc=org" scope=2 deref=0 filter="(objectClass=*)" Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 op=2 SRCH attr=* + Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text= Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 op=3 UNBIND Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 fd=359 closed ------- LDAP02's /etc/openldap/slapd.d/cn=config/olcDatabase={1}bdb.ldif: dn: olcDatabase={1}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcSuffix: dc=mydomain,dc=org olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,dc=mydomain,dc=org olcRootPW:: olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/ldap olcDbCacheSize: 50000 olcDbCheckpoint: 10240 720 olcSyncrepl: {0}rid=001 provider=ldap://ldap01.mydomain.org bindmethod=si mple timeout=1 network-timeout=0 binddn="cn=root,dc=mydomain,dc=org" credentials="ld4p3650" keepalive=0:0:0 starttls=yes filter="(objectclass=*)" s earchbase="dc=mydomain,dc=org" scope=sub schemachecking=off type=refr eshOnly interval=00:00:00:10 retry="5 5 300 5" tls_cacert=/etc/openldap/certs/rootCA.cert olcUpdateRef: ldap://ldap01.mydomain.org olcMirrorMode: TRUE olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass pres,eq olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: uidNumber pres,eq olcDbIndex: gidNumber pres,eq olcDbIndex: mail pres,eq,sub olcDbIndex: ou pres,eq,sub olcDbIndex: loginShell pres,eq olcDbIndex: sn pres,eq,sub olcDbIndex: givenName pres,eq,sub olcDbIndex: memberUid pres,eq,sub olcDbIndex: nisMapName pres,eq,sub olcDbIndex: nisMapEntry pres,eq,sub olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 31e2c8b0-c0ec-1033-8c20-43a6f59853d5 creatorsName: cn=config createTimestamp: 20140825214036Z entryCSN: 20140912164223.814325Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20140912164223Z ------- LDAP01's /etc/openldap/slapd.d/cn=config/olcDatabase={1}bdb.ldif: dn: olcDatabase={1}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcSuffix: dc=mydomain,dc=org olcAccess: {0}to attrs=userPassword by self write by anonymous auth by * no ne olcAccess: {1}to * by anonymous read olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,dc=mydomain,dc=org olcRootPW:: olcSyncUseSubentry: FALSE olcMirrorMode: TRUE olcMonitoring: TRUE olcDbDirectory: /var/lib/ldap olcDbCacheSize: 50000 olcDbCheckpoint: 10240 720 olcDbConfig: {0}# $OpenLDAP: pkg/ldap/servers/slapd/DB_CONFIG,v 1.3.2.4 2007/1 2/18 11:53:27 ghenry Exp $ olcDbConfig: {1}# Example DB_CONFIG file for use with slapd(8) BDB/HDB databas es. olcDbConfig: {2}# olcDbConfig: {3}# See the Oracle Berkeley DB documentation olcDbConfig: {4}# <http://www.oracle.com/technology/documentation/berkeley-d b/db/ref/env/db_config.html> olcDbConfig: {5}# for detail description of DB_CONFIG syntax and semantics. olcDbConfig: {6}# olcDbConfig: {7}# Hints can also be found in the OpenLDAP Software FAQ olcDbConfig:: ezh9Iwk8aHR0cDovL3d3dy5vcGVubGRhcC5vcmcvZmFxL2luZGV4LmNnaT9maWxl PTI+ olcDbConfig: {9}# in particular: olcDbConfig: {10}# <http://www.openldap.org/faq/index.cgi?file=1075> olcDbConfig: {11} olcDbConfig: {12}# Note: most DB_CONFIG settings will take effect only upon re building olcDbConfig: {13}# the DB environment. olcDbConfig: {14} olcDbConfig: {15}# one 0.25 GB cache olcDbConfig: {16}set_cachesize 0 268435456 1 olcDbConfig: {17} olcDbConfig: {18}# Data Directory olcDbConfig: {19}#set_data_dir db olcDbConfig: {20} olcDbConfig: {21}# Transaction Log settings olcDbConfig: {22}set_lg_regionmax 262144 olcDbConfig: {23}set_lg_bsize 2097152 olcDbConfig: {24}#set_lg_dir logs olcDbConfig: {25} olcDbConfig: {26}# Note: special DB_CONFIG flags are no longer needed for "qui ck" olcDbConfig:: ezI3fSMgc2xhcGFkZCg4KSBvciBzbGFwaW5kZXgoOCkgYWNjZXNzIChzZWUgdGhl aXIgLXEgb3B0aW9uKS4g olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass pres,eq olcDbIndex: entryUUID pres,eq olcDbIndex: entryCSN pres,eq olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: uidNumber pres,eq olcDbIndex: gidNumber pres,eq olcDbIndex: ou pres,eq,sub olcDbIndex: mail pres,eq,sub olcDbIndex: memberUid pres,eq,sub olcDbIndex: sn pres,eq,sub olcDbIndex: loginShell pres,eq olcDbIndex: givenName pres,eq,sub olcDbIndex: nisMapName pres,eq,sub olcDbIndex: nisMapEntry pres,eq,sub olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 727d260c-cc5c-1032-89cf-2fc7acd5ca31 creatorsName: cn=config createTimestamp: 20131018161654Z entryCSN: 20140915195740.431843Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20140915195740Z ------ Thanks, Josh Nielsen

3 3

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical