openldap-technical

openldap-technical@openldap.org

3 participants
9937 discussions

bug with smbldap ldap
by rodrigo tavares 17 Jun '14

17 Jun '14

Hello people, I'm try install samba e ldap. #the site that I below is a tutorial http://www.unixmen.com/setup-samba-domain-controller-with-openldap-backend-…. My OS is ubuntu, I have some troubles smbldap CRASH. How mean this log ? Sorry, command-not-found has crashed! Please file a bug report at: https://bugs.launchpad.net/command-not-found/+filebug Please include the following information with the report: command-not-found version: 0.3 Python version: 3.3.1 final 0 Distributor ID: Ubuntu Description: Ubuntu 13.04 Release: 13.04 Codename: raring Exception information: unsupported locale setting Traceback (most recent call last): File "/usr/lib/python3/dist-packages/CommandNotFound/util.py", line 24, in crash_guard callback() File "/usr/lib/command-not-found", line 69, in main enable_i18n() File "/usr/lib/command-not-found", line 40, in enable_i18n locale.setlocale(locale.LC_ALL, '') File "/usr/lib/python3.3/locale.py", line 541, in setlocale return _setlocale(category, locale) locale.Error: unsupported locale setting

3 2

ITS #7161, ppolicy pwdFailureTime resolution should be better than 1 second
by Paul B. Henson 16 Jun '14

16 Jun '14

I realize that development discussion is supposed to go to openldap-devel, but despite having subscribed to that a month ago, none of my postings have gone through. I hear they are having some technical difficulties with that list, so for the sake of this submission not being indefinitely delayed, here it is. Attached is a proposed patch to fix ITS #7161. It uses the same method as the accesslog module to generate a subsecond generalized time, appending the o_tincr value from the operation structure as fractional seconds. The only other code that looks at the value of that attribute calls parse_time to pull seconds out of it (ignoring the fractional second part), so other than modifying the format the attribute is stored in I don't believe there are any other changes required with this.

4 24

issue with bad data ? In MMR setup
by Daniel Jung 14 Jun '14

14 Jun '14

Hi, Ldap daemon was being restarted every so many minutes. All the consumers were out of sync and had to be re-synced. This specific master in question in MMR setup was restored from other master and the issue went away. running 2.4.37 on centos6 with hdb backend on the masters and lmdb on the consumers. Searching thru the list shows a lot of hits with "too old", AFAIK ntp is kept quite closely. serverid "000" no longer exists as it was decomissioned since last year, hence contextcsn is really old. Not sure if that played a role in this havoc or not. Could you tell me what "srs" and "log" means in the context below? Following is what I found in the log, and there were a lot of these which probably contributed to restart of the daemon: Jun 14 00:05:21 name of the server slapd[16745]: srs csn 20131226183611.000000Z#000000#000#000000 Jun 14 00:05:21 name of the server slapd[16745]: log csn 20131206192447.000000Z#000000#000#000000 Jun 14 00:05:21 name of the server slapd[16745]: cmp -2, too old Jun 14 00:05:21 name of the server slapd[16745]: log csn 20131206193513.000000Z#000000#000#000000 Jun 14 00:05:21 name of the server slapd[16745]: cmp -2, too old </snip> Jun 14 00:05:59 name of the server slapd[16745]: do_syncrep2: rid=0 01 (-1) Can't contact LDAP server </snip> Jun 14 00:06:15 name of the server slapd[16745]: log csn 20131229125124.532456Z#000000#001#000000 Jun 14 00:06:15 name of the server slapd[16745]: cmp -256, too old Jun 14 00:06:15 name of the server slapd[16745]: log csn 20131229125143.680121Z#000000#001#000000 Jun 14 00:06:15 name of the server slapd[16745]: cmp -256, too old Jun 14 00:06:15 name of the server slapd[16745]: log csn 2013122913 </snip> Jun 14 00:06:59 name of the server slapd[31392]: do_syncrep2: rid=000 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Jun 14 00:06:59 name of the server slapd[31392]: do_syncrep2: rid=000 cookie=rid=000,sid=002,csn=20140613220035.981531Z#000000#001#000000 Jun 14 00:06:59 name of the server slapd[31392]: do_syncrep2: rid=000 LDAP_RES_INTERMEDIATE - REFRESH_DELETE </snip> thank you

1 0

test050-syncrepl-multimaster fails on 2.4.39/mdb
by Jean Gillaux 13 Jun '14

13 Jun '14

Hello, When running test suite for openldap 2.4.39, I see test050-syncrepl-multimaster failing with mdb. Software is build with ./configure --enable-overlays Env is: lxc container 0.9.0.alpha3 running debian wheezy, gcc version 4.7.2 (Debian 4.7.2-5) Same test with hdb is ok. Here is test output: Cleaning up test run directory leftover from previous run. Running ./scripts/test050-syncrepl-multimaster for mdb... running defines.sh Initializing server configurations... Starting server 1 on TCP/IP port 9011... Using ldapsearch to check that server 1 is running... Inserting syncprov overlay on server 1... Starting server 2 on TCP/IP port 9012... Using ldapsearch to check that server 2 is running... Configuring syncrepl on server 2... Starting server 3 on TCP/IP port 9013... Using ldapsearch to check that server 3 is running... Configuring syncrepl on server 3... Starting server 4 on TCP/IP port 9014... Using ldapsearch to check that server 4 is running... Configuring syncrepl on server 4... Adding schema and databases on server 1... Using ldapadd to populate server 1... Waiting 15 seconds for syncrepl to receive changes... Using ldapsearch to read config from server 1... Using ldapsearch to read config from server 2... Using ldapsearch to read config from server 3... Using ldapsearch to read config from server 4... Comparing retrieved configs from server 1 and server 2... Comparing retrieved configs from server 1 and server 3... Comparing retrieved configs from server 1 and server 4... Using ldapsearch to read all the entries from server 1... Using ldapsearch to read all the entries from server 2... Using ldapsearch to read all the entries from server 3... Using ldapsearch to read all the entries from server 4... Comparing retrieved entries from server 1 and server 2... test failed - server 1 and server 2 databases differ The diff between 1 and 2 is: 363,388d362 < dn: cn=Manager,dc=example,dc=com < objectClass: person < cn: Manager < cn: Directory Manager < cn: Dir Man < sn: Manager < description: Manager of the directory < userPassword:: c2VjcmV0 < < dn: cn=Mark Elliot,ou=Alumni Association,ou=People,dc=example,dc=com < objectClass: OpenLDAPperson < cn: Mark Elliot < cn: Mark A Elliot < sn: Elliot < uid: melliot < postalAddress: Alumni Association $ 111 Maple St $ Anytown, MI 48109 < seeAlso: cn=All Staff,ou=Groups,dc=example,dc=com < homePostalAddress: 199 Outer Drive $ Ypsilanti, MI 48198 < homePhone: +1 313 555 0388 < drink: Gasoline < title: Director, UM Alumni Association < mail: melliot(a)mail.alumni.example.com < pager: +1 313 555 7671 < facsimileTelephoneNumber: +1 313 555 7762 < telephoneNumber: +1 313 555 4177 < 395,409d368 < < dn: cn=Ursula Hampster,ou=Alumni Association,ou=People,dc=example,dc=com < objectClass: OpenLDAPperson < cn: Ursula Hampster < sn: Hampster < uid: uham < title: Secretary, UM Alumni Association < postalAddress: Alumni Association $ 111 Maple St $ Anytown, MI 48109 < seeAlso: cn=All Staff,ou=Groups,dc=example,dc=com < homePostalAddress: 123 Anystreet $ Anytown, MI 48104 < mail: uham(a)mail.alumni.example.com < homePhone: +1 313 555 8421 < pager: +1 313 555 2844 < facsimileTelephoneNumber: +1 313 555 9700 < telephoneNumber: +1 313 555 5331 Do you have any suggestion regarding this? Thanks -- Jean

2 5

Re: AD pass through to Openladp?
by Justin Stanczak 12 Jun '14

12 Jun '14

This is probably better posted on the Kerberos list, but can Kerberos server work with AD? Meaning set up a Kerberos server (not MS) to authenticate users, and AD accepts tickets from that? On Tue, Jun 10, 2014 at 9:36 AM, Stewart Walters <stewart.walters(a)gmail.com> wrote: > Hi Justin, > > My emails don't seem to arrive to the openldap-technical list. > > But, (and please note, I've never actually done this before) you could use > a virtual LDAP directory front-end to combine portions of both AD and > OpenLDAP to provide clients with a single unified view. In theory the > client can't tell the difference between data from one or the other (though > I imagine that the theory and the practice of this is completely different, > which is why I've never attempted this). > > Such products that provide this are MyVD (http://myvd.sourceforge.net/) > and some commercial ones like RadiantOne VDS, Virtual Identity Server, > Virtual LDAP Server EE > > However all of that complicates what should be a relatively simple thing - > storing and retrieving an identity held within a directory. I wouldn't > recommend looking at virtual directories as a way forward, you're likely to > run in to bigger problems by over engineering the solution. > > I find its best to keep things simple. Either keep the OpenLDAP and AD > identities separate between the two directories, or if you have to, look > towards suggestions made by others (such as using Kerberos V5 Trusted > Realm+OpenLDAP; or Samba+OpenLDAP). > > Best of luck, > > Stewart > > >

2 1

chaining a subordinate database only?
by Marc Patermann 12 Jun '14

12 Jun '14

Hello, http://www.openldap.org/doc/admin24/overlays.html#Chaining says: "On each replica, add this near the top of the slapd.conf(5) file (global), before any database definitions" - so chaining works as a global directive for all databases in the example. I get it to work this way. But I want chaining only for a single subordinate db, not for all. I do not get this working. It behaves like there is not chaining. Is this even possible? The basic layout is like this: database mdb suffix ou=system,ou=foo subordinate database mdb suffix ou=linux,ou=foo subordinate overlay chaining overlay ppolicy database mdb suffix ou=foo ppolicy must only work for ou=linux. That is why, it is a database of its own. (Is there another way?). The ppolicy attributes should be replicated to all the slaves. As far as I understood it, I have to chain the database to the master to replicate the attributes. (Right?) Marc

1 0

Password History check in openldap
by scor z 10 Jun '14

10 Jun '14

Password History check in openldap not working when I am using SHA-256 password hashing in openldap. So I am sending clear text password from my java application to openLDAP and it is storing as SHA-256 hashed form on its own. whenever I am changing password, openLDAP is storing the previous password in pwdHistory. There is no problem in that but when I am changing password with the same password previously used it is taking up without throwing any error. I am struggling to make it work for few weeks. Please somebody help me. My environment details: OpenLDAP 2.4.38 RHEL 6 Following details also mentioned in slapd.conf include ../etc/openldap/schema/ppolicy.schema password-hash {SHA256} overlay ppolicy ppolicy_default "cn=default,ou=pwdpolicies,dc=my-domain,dc=com" ppolicy_hash_cleartext my password policy: dn: cn=Default,ou=pwdpolicies,dc=my-domain,dc=com objectClass: pwdPolicy objectClass: person objectClass: top cn: Default sn: Default pwdAttribute: userPassword pwdMinAge: 0 pwdInHistory: 5 pwdFailureCountInterval: 0 pwdLockout: TRUE pwdLockoutDuration: 0 pwdAllowUserChange: TRUE pwdExpireWarning: 0 pwdGraceAuthNLimit: 0 pwdMustChange: FALSE pwdSafeModify: FALSE Kindly let me know if I have to give me more information to nail down the issue. Please Please Please someone help me on this. I am badly need a solution on this.

3 2

Re: AD pass through to Openladp?
by Justin Stanczak 10 Jun '14

10 Jun '14

I want to keep the password part in the current LDAP so we don't have to do a mass reset for all parties. And I didn't want to move the LDAP to an MS product. Thanks for the information. On Fri, Jun 6, 2014 at 8:08 PM, Stewart Walters <stewart.walters(a)gmail.com> wrote: > Just spit balling here, because I'm not exactly sure I completely > understand your usage scenario. > > You say you want AD to use OpenLDAP as the authentication source, I > presume so that Windows workstation logins can authenticate against an > identity in OpenLDAP? > > If Group Policy/File and Printer management and other aspects of AD aren't > hugely important to the control and management of your workstation fleet, > you could deploy pGina (pgina.org) to every workstation. pGina will > replace the windows Ctrl + Alt + Del style login screen with one that will > allow users to authenticate directly to an identity in OpenLDAP. > > If that's not your scenario (or if you need the Group Policy/File and > Print stuff), as Peter correctly asserts - Samba 3/4 can be used as a drop > in replacement for AD. It can also be configured to use Kerberos and > OpenLDAP on the backend to control identity and authentication. Without > having to learn Samba (which by extension, often requires you to know low > level concepts of AD itself), you could also consider a FreeIPA deployment > which may or may not assist with simplifying the configuration of Samba4. > > Another way would be to use an IDAM product such as Microsoft Forefront > Identity Manager (or the Quest or NetIQ equivalents) to replicate > user identities and passwords in AD over to OpenLDAP (and vice versa). I > suspect however that an IDAM project is probably too over-engineered/too > expensive for your needs. > > Hope that helps, > > Stewart > > >

1 0

LMDB and multiple processes
by Brian G. Merrell 07 Jun '14

07 Jun '14

Hi all, First, I'm having trouble finding resources to answer a question like this myself, so please forgive me if I've missed something. I'm considering using LMDB (versus LevelDB) for a project I'm working on where I'll be receiving a high volume (hundreds per second) of high priority requests (over HTTP) and issuing multiple (<10) database queries per request. I'll also have a separate process receiving updates for the data and writing to the database. This will happen often (several times a minute, perhaps), but the priority is much lower than the read requests. LMDB appealed to me because of the read performance and that I could have one processing reading data from LMDB and another process writing data updates to LMDB. For proof of concept, I hacked up the following (I'll use pseudocode since I used the Go bindings for my actual programs, and hopefully my question is sufficiently abstract not to matter): Process 1, the writer, simply writes a random integer (from 0 to 1000) to a defined set of keys: env = NewEnv() env.Open("/tmp/foo", 0, 0664) txn = env.BeginTxn(nil, 0) dbi = txn.DBIOpen(nil, 0) txn.Commit() txn = env.BeginTxn(nil, 0) n_entries = 5 for i = 0; i < n_entries; i++ { key = sprintf("Key-%d", i) val = sprintf("Val-%d", rand.Int(1000)) txn.Put(dbi, key, val, 0) } txn.Commit() env.DBIClose(dbi) env.Close() Process 2, the reader, simply loops forever and does random access reads on the data from process 1 (I won't benefit from a cursor for my actual problem), and prints out that data occasionally: env = NewEnv() env.Open("/tmp/foo", 0, 0664) while { txn = BeginTxn(nil, 0) dbi = txn.DBIOpen(nil, 0) txn.Commit() for i = 0; i < n_entries; i++ { key = sprintf("Key-%d", i) val = txn.Get(dbi, key) print("%s: %s", key, value) } env.DBIClose(dbi) sleep(5) } So my high level question is: What am I doing wrong? This seems to work OK, but a lot of it was guesswork, so I'm sure I'm doing some silly things. For example, first I put the BeginTxn() and DBIOpen() calls in process 2 outside of the while loop, but when I did that, I never saw the updates values upon running process 1 simultaneously. In my real-world application, it seems like adding these calls to every request (to be sure the data being read is up-to-date) could be an unnecessary performance penalty. I was suspect there are flags that I can/should be using, but I'm not sure. Thanks for any input. Brian

2 6

Problems using StartTls with openldap-2.4.31
by Andrei Cipu 06 Jun '14

06 Jun '14

Hi all, I'm using openldap-2.4.31 compiled with gnutls25 on Rapsbmc (pre-compiled by the distribution) and I'm trying to make ldap+StartTls work with ldapsearch (simple ldap:// works like a charm). After hitting the issue described at [1] , I've decided to use a self-signed CA cert generated with certtool, as described in [2]. This allowed me to establish the TLS connection. However, the client still sends the bind in clear text, then the server closes the connection. The slapd.conf file is below (comments stripped; the client has the same CACert and cipher suites): > include /etc/ldap/schema/core.schema > include /etc/ldap/schema/cosine.schema > include /etc/ldap/schema/nis.schema > include /etc/ldap/schema/inetorgperson.schema > include /etc/ldap/schema/samba.schema > > pidfile /var/run/slapd/slapd.pid > > argsfile /var/run/slapd/slapd.args > > loglevel -1 > > modulepath /usr/lib/ldap > moduleload back_hdb > > sizelimit 500 > > tool-threads 1 > > TLSCACertificateFile /etc/ldap/certs/selfsign/ca-cert.pem > TLSCertificateKeyFile /etc/ldap/certs/selfsign/key.pem > TLSCertificateFile /etc/ldap/certs/selfsign/cert.pem > TLSCipherSuite NONE:+VERS-TLS1.2:+VERS-TLS1.1:+VERS-TLS1.0:+COMP-ALL:+AES-256-CBC:+CAMELLIA-256-CBC:+RSA:+SHA1:+SHA256 > TLSVerifyClient never The client output: > root@argyle:/home/pi# ldapsearch -x -H ldap://127.0.0.1 -Z -b 'dc=strainu,dc=ro' -Dcn=admin,dc=strainu,dc=ro -w bla > ldap_start_tls: Connect error (-11) > additional info: (unknown error code) > ldap_result: Can't contact LDAP server (-1) And finally the server output: > root@argyle:/etc/ldap# /usr/sbin/slapd -g openldap -u openldap -f /etc/ldap/slapd.conf -d -1 > 53923fb1 @(#) $OpenLDAP: slapd (Apr 24 2013 17:35:25) $ buildd@build07.raspbian.lan:/build/openldap-nxJLrU/openldap-2.4.31/debian/build/servers/slapd > ldap_pvt_gethostbyname_a: host=argyle, r=0 > 53923fb1 daemon_init: <null> > 53923fb1 daemon_init: listen on ldap:/// > 53923fb1 daemon_init: 1 listeners to open... > ldap_url_parse_ext(ldap:///) > 53923fb1 daemon: listener initialized ldap:/// > 53923fb1 daemon_init: 2 listeners opened > ldap_create > 53923fb1 slapd init: initiated server. > > [...] > > 53923ffe connection_read(12): unable to get TLS client DN, error=49 id=1000 > 53923ffe conn=1000 fd=12 TLS established tls_ssf=256 ssf=256 > 53923ffe daemon: activity on 1 descriptor > 53923ffe daemon: activity on:53923ffe > 53923ffe daemon: epoll: listen=6 active_threads=0 tvp=zero > 53923ffe daemon: epoll: listen=7 active_threads=0 tvp=zero > 53923ffe daemon: activity on 1 descriptor > 53923ffe daemon: activity on:53923ffe 12r53923ffe > 53923ffe daemon: read active on 12 > 53923ffe connection_get(12) > 53923ffe connection_get(12): got connid=1000 > 53923ffe connection_read(12): checking for input on id=1000 > ber_get_next > tls_read: want=5, got=5 > 0000: 30 33 02 01 02 03... > ldap_read: want=8 error=Success > 53923ffe ber_get_next on fd 12 failed errno=0 (Success) > 53923ffe connection_read(12): input error=-2 id=1000, closing. > 53923ffe connection_closing: readying conn=1000 sd=12 for close > 53923ffe connection_close: conn=1000 sd=12 > 53923ffe daemon: removing 12 > tls_write: want=53, written=53 > 0000: 15 03 03 00 30 c2 bb c0 ae 12 fa 04 27 45 11 6e ....0.......'E.n > 0010: d7 08 20 97 49 59 0b 35 c5 77 2d b5 65 a0 97 a4 .. .IY.5.w-.e... > 0020: b0 3a eb aa b1 e7 71 8b 3e 0c 73 60 e3 9b 66 8c .:....q.>.s`..f. > 0030: f8 94 e0 c6 50 ....P > 53923ffe daemon: epoll: listen=6 active_threads=0 tvp=zero > 53923ffe daemon: epoll: listen=7 active_threads=0 tvp=zero > 53923ffe daemon: activity on 1 descriptor > 53923ffe daemon: activity on:53923ffe > 53923ffe daemon: epoll: listen=6 active_threads=0 tvp=zero > 53923ffe daemon: epoll: listen=7 active_threads=0 tvp=zero > 53923ffe conn=1000 fd=12 closed (connection lost) As you can see, the server declares the TLS established, then tries to read something, receives 5 bytes which indicates the ldap protocol (I believe), then comes the part I can't decode: > ldap_read: want=8 error=Success > 53923ffe ber_get_next on fd 12 failed errno=0 (Success) > 53923ffe connection_read(12): input error=-2 id=1000, closing. What's with the "failed errno=0" and why does the server close the connection? What should I change in the config to make it work? If you need any more information I'll provide it - I selected the part that seemed relevant to me. Thank a lot for any ideas, Andrei [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737921#25 [2] http://www.gnutls.org/manual/html_node/certtool-Invocation.html

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical