openldap-technical

openldap-technical@openldap.org

3 participants
9990 discussions

Password Failure for one user
by brown wrap 01 Aug '14

01 Aug '14

I am trying to track down why one user all of a sudden can't log into a machine. He can use his LDAP passwd through our network, but gets an immediate login failure on a particular machine. I can 'su' to his account, from my account using his password, but when I try to log into this machine remotely, I get the failure and it terminates the sessions. There have been no changes to the system at all. I am looking for step to troubleshoot this issue. Thanks.

2 2

Q: cn=Connection 0,cn=Connections,cn=Monitor
by Ulrich Windl 01 Aug '14

01 Aug '14

Hi! I'm browsing the monitor database for routine, and I founf this "Connectio 0": # Connection 0, Connections, Monitor dn: cn=Connection 0,cn=Connections,cn=Monitor monitorConnectionNumber: 0 monitorConnectionProtocol: 0 monitorConnectionOpsReceived: 4 monitorConnectionOpsExecuting: 0 monitorConnectionOpsPending: 0 monitorConnectionOpsCompleted: 4 monitorConnectionGet: 6 monitorConnectionRead: 6 monitorConnectionWrite: 0 monitorConnectionMask: L monitorConnectionListener: monitorConnectionPeerDomain: unknown monitorConnectionPeerAddress: unknown monitorConnectionLocalAddress: monitorConnectionStartTime: 19700101000000Z monitorConnectionActivityTime: 19700101000000Z Is it a bug that Start and Activity time are both unset? If the reads and writes of the connection can be counted, the timestamps could be updated as well, I guess. It's 2.4.26 here, so maybe it has been fixed meanwhile... I just saw that I have a second "connection 0": # Connection 0, Connections, Monitor dn: cn=Connection 0,cn=Connections,cn=Monitor monitorConnectionNumber: 0 monitorConnectionProtocol: 0 monitorConnectionOpsReceived: 4 monitorConnectionOpsExecuting: 0 monitorConnectionOpsPending: 0 monitorConnectionOpsCompleted: 4 monitorConnectionGet: 6 monitorConnectionRead: 6 monitorConnectionWrite: 0 monitorConnectionMask: L monitorConnectionListener: monitorConnectionPeerDomain: unknown monitorConnectionPeerAddress: unknown monitorConnectionLocalAddress: monitorConnectionStartTime: 19700101000000Z monitorConnectionActivityTime: 19700101000000Z Doing a simple quick-and-dirty test, I found out that I have multiple "Connection 0"s: sh monitor2.sh |grep '^# Connection' |sort -n SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 # Connection 0, Connections, Monitor # Connection 0, Connections, Monitor # Connection 0, Connections, Monitor # Connection 0, Connections, Monitor # Connection 0, Connections, Monitor # Connection 0, Connections, Monitor # Connection 0, Connections, Monitor # Connection 0, Connections, Monitor # Connection 0, Connections, Monitor # Connection 1000, Connections, Monitor # Connection 1001, Connections, Monitor # Connection 1008, Connections, Monitor # Connection 1013, Connections, Monitor # Connection 1016, Connections, Monitor # Connection 1017, Connections, Monitor # Connection 1018, Connections, Monitor # Connection 1020, Connections, Monitor # Connection 1021, Connections, Monitor # Connection 1024, Connections, Monitor # Connection 1036, Connections, Monitor # Connection 1040, Connections, Monitor # Connection 1042, Connections, Monitor # Connection 1043, Connections, Monitor # Connection 1118, Connections, Monitor # Connection 1201, Connections, Monitor # Connection 1247, Connections, Monitor # Connection 1380, Connections, Monitor # Connection 14755, Connections, Monitor # Connection 14758, Connections, Monitor # Connection 15369, Connections, Monitor # Connection 15800, Connections, Monitor # Connection 15886, Connections, Monitor # Connection 16674, Connections, Monitor # Connection 20526, Connections, Monitor # Connection 20626, Connections, Monitor # Connection 21044, Connections, Monitor # Connection 21460, Connections, Monitor # Connection 21474, Connections, Monitor # Connection 21688, Connections, Monitor # Connection 25846, Connections, Monitor # Connection 30396, Connections, Monitor # Connection 30665, Connections, Monitor # Connection 31948, Connections, Monitor # Connection 35407, Connections, Monitor # Connection 35953, Connections, Monitor # Connection 36575, Connections, Monitor # Connection 36576, Connections, Monitor # Connection 36577, Connections, Monitor # Connection 36648, Connections, Monitor # Connection 50382, Connections, Monitor # Connection 50599, Connections, Monitor # Connection 50706, Connections, Monitor # Connection 51477, Connections, Monitor # Connection 55650, Connections, Monitor # Connection 55651, Connections, Monitor # Connection 56206, Connections, Monitor # Connection 61141, Connections, Monitor # Connection 61144, Connections, Monitor # Connection 61152, Connections, Monitor # Connection 61153, Connections, Monitor # Connection 61162, Connections, Monitor # Connection 61163, Connections, Monitor # Connection 61164, Connections, Monitor # Connection 61165, Connections, Monitor # Connection 61166, Connections, Monitor # Connection 61167, Connections, Monitor # Connection 61168, Connections, Monitor # Connection 62161, Connections, Monitor # Connection 65286, Connections, Monitor # Connection 67224, Connections, Monitor # Connection 70109, Connections, Monitor # Connection 70162, Connections, Monitor # Connection 70516, Connections, Monitor # Connection 70528, Connections, Monitor # Connection 70529, Connections, Monitor # Connections, Monitor Regards, Ulrich

2 1

Antw: Setting up Monitor Backend
by Ulrich Windl 31 Jul '14

31 Jul '14

>>> Leonard Smith <lrsmith(a)umich.edu> schrieb am 31.07.2014 um 21:52 in Nachricht <CAP9L-w5pR5z80_aTgt_ux2xUpH4gu-kA_Y5zd2VZuNfE9kgfQg(a)mail.gmail.com>: > To all, > > I'm trying to setup the monitoring backend so I can get metrics in OpenLDAP > 2.4.23 on Centos 6. I have it setup and I can query but I don't seem to be > getting any metrics/values. I check the olcAccess rules and it should be > allowing access so I"m not sure why I cannot see any values for any of the > monitoring points. > > > sh-4.1# ldapsearch -Y EXTERNAL -H ldapi:/// -b > 'cn=Total,cn=Connections,cn=Monitor' Hi! Try " ldapsearch -Y EXTERNAL -H ldapi:/// -b 'cn=Total,cn=Connections,cn=monitor' -s sub '(objectClass=*)' monitorCounter". I got: # Total, Connections, Monitor dn: cn=Total,cn=Connections,cn=Monitor monitorCounter: 70315 Regards, Ulrich > SASL/EXTERNAL authentication started > SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth > SASL SSF: 0 > # extended LDIF > # > # LDAPv3 > # base <cn=Total,cn=Connections,cn=Monitor> with scope subtree > # filter: (objectclass=*) > # requesting: ALL > # > > # Total, Connections, Monitor > dn: cn=Total,cn=Connections,cn=Monitor > objectClass: monitorCounterObject > cn: Total > > # search result > search: 2 > result: 0 Success > > # numResponses: 2 > # numEntries: 1 > > dn: olcDatabase={1}monitor > objectClass: olcDatabaseConfig > olcDatabase: {1}monitor > olcAddContentAcl: FALSE > olcLastMod: TRUE > olcMaxDerefDepth: 15 > olcReadOnly: FALSE > olcSyncUseSubentry: FALSE > olcMonitoring: FALSE > structuralObjectClass: olcDatabaseConfig > entryUUID: 4313fd2c-b0ec-1032-8c14-c907d74f027d > creatorsName: cn=config > createTimestamp: 20130913181549Z > olcAccess: {0}to * by > dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by > dn.base="cn=manager > ,dc=foo,dc=com" read by dn.base="cn=monitor,dc=foo,dc=com" read by * none

1 0

syncrepl_del_nonpresent leading to directory implosion
by Aaron Bennett 10 Jul '14

10 Jul '14

Hi, I've got a two-node MMR setup using syncrepl running 2.4.36 with back-bdb. Last night, between 1/3 and 1/2 of the entries in our directory disappeared. Fortunately I have olcLogLeve=sync set, so I think I have a line on what happened... I see this at 4AM long of the morning before the fun started: Jul 7 04:19:30 zoot slapd[15011]: bdb(dc=clarku,dc=edu): Lock table is out of available lock entries Jul 7 04:19:30 zoot slapd[15011]: => bdb_idl_insert_key: c_get failed: Cannot allocate memory (12) Then many hours later: Jul 7 15:04:30 zoot slapd[15011]: bdb(dc=clarku,dc=edu): Lock table is out of available lock entries Jul 7 15:04:30 zoot slapd[15011]: => bdb_idl_delete_key: c_get failed: Cannot allocate memory (12) Jul 7 15:04:30 zoot slapd[15011]: null_callback : error code 0x50 Jul 7 15:04:30 zoot slapd[15011]: slap_graduate_commit_csn: removing 0x7fa33c248a80 20140707190424.188580Z#000000#001#000000 Jul 7 15:04:30 zoot slapd[15011]: syncrepl_del_nonpresent: rid=001 be_delete cn=parents_ug_students,ou=Other,ou=Groups,dc=clarku,dc=edu (80) This repeats itself several times: Jul 7 16:41:09 zoot slapd[15011]: syncprov_matchops: skipping original sid 001 Jul 7 16:41:09 zoot slapd[15011]: bdb(dc=clarku,dc=edu): Lock table is out of available lock entries Jul 7 16:41:09 zoot slapd[15011]: => bdb_idl_delete_key: c_get failed: Cannot allocate memory (12) Jul 7 16:41:09 zoot slapd[15011]: null_callback : error code 0x50 Jul 7 16:41:09 zoot slapd[15011]: slap_graduate_commit_csn: removing 0x7fa37e4b4260 20140707204059.442906Z#000000#001#000000 Jul 7 16:41:09 zoot slapd[15011]: syncrepl_del_nonpresent: rid=001 be_delete cn=parents_ug_students,ou=Other,ou=Groups,dc=clarku,dc=edu (80) Jul 7 16:52:44 zoot slapd[2179]: bdb(dc=clarku,dc=edu): Lock table is out of available lock entries Jul 7 16:52:44 zoot slapd[2179]: => bdb_idl_delete_key: c_get failed: Cannot allocate memory (12) Jul 7 16:52:44 zoot slapd[2179]: null_callback : error code 0x50 Jul 7 16:52:44 zoot slapd[2179]: slap_graduate_commit_csn: removing 0x7f74581dae70 20140707205225.029175Z#000000#001#000000 Jul 7 16:52:44 zoot slapd[2179]: syncrepl_del_nonpresent: rid=001 be_delete cn=parents_ug_students,ou=Other,ou=Groups,dc=clarku,dc=edu (80) Jul 7 16:52:44 zoot slapd[2179]: slap_queue_csn: queing 0x7f7458be8470 20140707205225.029175Z#000000#001#000000 Jul 7 16:52:44 zoot slapd[2179]: slap_graduate_commit_csn: removing 0x7f74581ad2e0 20140707205225.029175Z#000000#001#000000 Then we get (possibly unrelated) a lengthy list of nonpresent_callbacks (tons more then I list here): Jul 7 17:06:24 zoot slapd[2179]: nonpresent_callback: rid=001 present UUID 5111f346-871c-1033-8d4b-f5dbd10b8ca0, dn uid=rvenkatachalam,ou=Users,dc=clarku,dc=edu Jul 7 17:06:24 zoot slapd[2179]: nonpresent_callback: rid=001 present UUID 1e3d94e4-8ce8-1033-8d6a-f5dbd10b8ca0, dn cn=BIOL399-09-SU14,ou=Courses,ou=Groups,dc=clarku,dc=edu Jul 7 17:06:24 zoot slapd[2179]: nonpresent_callback: rid=001 present UUID 45843aa6-91b8-1033-81a9-ff6ec337b146, dn cn=MSPC3090-01-F14,ou=Courses,ou=Groups,dc=clarku,dc=edu Jul 7 17:06:24 zoot slapd[2179]: nonpresent_callback: rid=001 present UUID 4dd09f16-921b-1033-8d8e-f5dbd10b8ca0, dn cn=msit3710-01-f14,ou=DL,ou=Groups,dc=clarku,dc=edu Jul 7 17:06:24 zoot slapd[2179]: nonpresent_callback: rid=001 present UUID 0b3e8d76-9607-1033-81cf-ff6ec337b146, dn cn=acct5411-01-f14,ou=DL,ou=Groups,dc=clarku,dc=edu Jul 7 17:06:24 zoot slapd[2179]: nonpresent_callback: rid=001 present UUID a698a278-9677-1033-81ee-ff6ec337b146, dn cn=ESL0051-E1-F14,ou=Courses,ou=Groups,dc=clarku,dc=edu Jul 7 17:06:24 zoot slapd[2179]: nonpresent_callback: rid=001 present UUID ccf94c1c-979c-1033-8dc9-f5dbd10b8ca0, dn uid=dgunarajasingam,ou=Users,dc=clarku,dc=edu Followed by another lock table / del_nonpresent: Jul 7 17:06:24 zoot slapd[2179]: bdb(dc=clarku,dc=edu): Lock table is out of available lock entries Jul 7 17:06:24 zoot slapd[2179]: => bdb_idl_delete_key: c_del id failed: Cannot allocate memory (12) Jul 7 17:06:24 zoot slapd[2179]: null_callback : error code 0x50 Jul 7 17:06:24 zoot slapd[2179]: slap_graduate_commit_csn: removing 0x7f73e016cb40 20140707210614.062782Z#000000#001#000000 Jul 7 17:06:24 zoot slapd[2179]: syncrepl_del_nonpresent: rid=001 be_delete cn=parents_ug_students,ou=Other,ou=Groups,dc=clarku,dc=edu (80) Jul 7 17:06:24 zoot slapd[2179]: slap_queue_csn: queing 0x7f73e0f0eaa0 20140707210614.062782Z#000000#001#000000 Jul 7 17:06:24 zoot slapd[2179]: slap_graduate_commit_csn: removing 0x7f73e0f180c0 20140707210614.062782Z#000000#001#000000 That repeats itself @ 18:07, 18:47, 18:55. Then the train departs for crazy town... notice this is the other node: ul 7 18:55:59 animal slapd[10389]: nonpresent_callback: rid=002 nonpresent UUID 0e6fea9e-9279-1033-8d97-f5dbd10b8ca0, dn cn=MSPC3070-01-F14,ou=Courses,ou=Groups,dc=clarku,dc=edu Jul 7 18:55:59 animal slapd[10389]: nonpresent_callback: rid=002 nonpresent UUID f710e364-958c-1033-8da2-f5dbd10b8ca0, dn cn=MKT5900-01-F14,ou=Courses,ou=Groups,dc=clarku,dc=edu Jul 7 18:55:59 animal slapd[10389]: nonpresent_callback: rid=002 nonpresent UUID 815ece60-965e-1033-8dab-f5dbd10b8ca0, dn cn=ESL0067-M1-F14,ou=Courses,ou=Groups,dc=clarku,dc=edu Jul 7 18:55:59 animal slapd[10389]: nonpresent_callback: rid=002 nonpresent UUID f9d8a408-96cf-1033-8db0-f5dbd10b8ca0, dn cn=eng2950-01-su14,ou=DL,ou=Groups,dc=clarku,dc=edu Jul 7 18:55:59 animal slapd[10389]: nonpresent_callback: rid=002 nonpresent UUID 480d8cbc-96d3-1033-8dbf-f5dbd10b8ca0, dn cn=esl0011-e1-f14,ou=DL,ou=Groups,dc=clarku,dc=edu Jul 7 18:55:59 animal slapd[10389]: nonpresent_callback: rid=002 nonpresent UUID ccf94c1c-979c-1033-8dc9-f5dbd10b8ca0, dn uid=dgunarajasingam,ou=Users,dc=clarku,dc=edu Jul 7 18:55:59 animal slapd[10389]: slap_graduate_commit_csn: removing 0x7f59c8eddc00 20140707225554.051198Z#000000#002#000000 Jul 7 18:55:59 animal slapd[10389]: syncrepl_del_nonpresent: rid=002 be_delete cn=MPA3950-03-SU14,ou=Courses,ou=Groups,dc=clarku,dc=edu (0) Jul 7 18:55:59 animal slapd[10389]: syncprov_matchops: skipping original sid 002 Jul 7 18:55:59 animal slapd[10389]: syncrepl_del_nonpresent: rid=002 be_delete cn=MSIT3950-0R-SU14,ou=Courses,ou=Groups,dc=clarku,dc=edu (0) Jul 7 18:55:59 animal slapd[10389]: syncprov_matchops: skipping original sid 002 Jul 7 18:55:59 animal slapd[10389]: syncrepl_del_nonpresent: rid=002 be_delete uid=zbamberger,ou=Users,dc=clarku,dc=edu (0) Jul 7 18:55:59 animal slapd[10389]: syncprov_matchops: skipping original sid 002 Jul 7 18:55:59 animal slapd[10389]: syncrepl_del_nonpresent: rid=002 be_delete uid=dgunarajasingam,ou=Users,dc=clarku,dc=edu (0) Jul 7 18:55:59 animal slapd[10389]: syncprov_matchops: skipping original sid 002 Jul 7 18:55:59 animal slapd[10389]: syncrepl_del_nonpresent: rid=002 be_delete uid=hmunawar,ou=Users,dc=clarku,dc=edu (0) Jul 7 18:55:59 animal slapd[10389]: syncprov_matchops: skipping original sid 002 Jul 7 18:55:59 animal slapd[10389]: syncrepl_del_nonpresent: rid=002 be_delete cn=scrn2940-01-su14,ou=DL,ou=Groups,dc=clarku,dc=edu (0) Jul 7 18:55:59 animal slapd[10389]: syncprov_matchops: skipping original sid 002 Jul 7 18:55:59 animal slapd[10389]: syncrepl_del_nonpresent: rid=002 be_delete cn=eng2940-02-su14,ou=DL,ou=Groups,dc=clarku,dc=edu (0) Jul 7 18:55:59 animal slapd[10389]: syncprov_matchops: skipping original sid 002 Jul 7 18:55:59 animal slapd[10389]: syncrepl_del_nonpresent: rid=002 be_delete cn=id2940-02-su14,ou=DL,ou=Groups,dc=clarku,dc=edu (0) Jul 7 18:55:59 animal slapd[10389]: syncprov_matchops: skipping original sid 002 Jul 7 18:55:59 animal slapd[10389]: syncrepl_del_nonpresent: rid=002 be_delete cn=msit3950-0p-su14,ou=DL,ou=Groups,dc=clarku,dc=edu (0) Jul 7 18:55:59 animal slapd[10389]: syncprov_matchops: skipping original sid 002 Jul 7 18:55:59 animal slapd[10389]: syncrepl_del_nonpresent: rid=002 be_delete cn=mspc3060-0p-su14,ou=DL,ou=Groups,dc=clarku,dc=edu (0) That goes on, deleting things, until my pager exploded when some critical role accounts got nuked and our radius servers died. I pulled an LDIF when I realized what was happening and between 18:55 and 19:35, our LDIF went from 75MB to 45MB - so about 30MB of stuff disappeared. What happened? Did I get hit by an oddball BDB/Syncrepl behavior? Do I have a bad misconfiguration in my replication setup? Thanks for your time, Aaron ---- Manager of Systems Administration Clark University ITS

3 3

Outlook LDAP Addressbook Browsing - Add ORDERING caseIgnoreOrderingMatch on CN or NAME core attributes without source code modification and re-compilition
by Richard LEGER 10 Jul '14

10 Jul '14

Hi, We currently used openldap as provided out of the box (binary) by Ubuntu 12.04 LTS. We need to enable Outlook LDAP Addressook browsing when used with our OpenLDAP current setup. According to past posts on the OpenLDAP technical mailing list, there seems to be two requirements: - Add ORDERING caseIgnoreOrderingMatch in the definition of core schema attribute CN (or Name) - Enable LDAP Virtual List View (VLV - OID: 2.16.840.1.113730.3.4.9) control and Server Side Control (SSS - OID: 1.2.840.113556.1.4.473) control on the OpenLDAP server ### Modify (or extend, or replace) definition of core schema attribute As per those posts below, it is possible to mofidy core schema attribute(s) by updating source code and recompiling openldap. http://www.openldap.org/cgi-bin/wilma_hiliter/openldap-technical/201001/msg… http://www.openldap.org/cgi-bin/wilma_hiliter/openldap-technical/201212/msg… Unfortunately this is not an option for us. Is there other way(s) via a local schema or else to modify/extend definition of OpenLDAP core attributes without modifying source code and recompiling? Via ldpamodify or via the creation of a module/overlay maybe that could be loaded via openldap configuration file slapd.conf at startup? The slapd.conf method would be our preference at the moment. As last resort, if not technically possible via slapd.conf, would using the OpenLDAP On-Line Configuration (OLC - cn=config - slapd.config) method instead allow such extend/modification of core schema attributes? If yes how? We are aware that may render our ldapserver no longer fully RFC compliant, but we need to be pragmatic here to provide an effective solution to end-users. We already use our own local LDAP schema definition anyway :-) Thank in advance for your any help/enlightenment you could provide. ### VLV and SSS Control(s) have been enabled as follow # Added the following in /etc/ldap/sldap.conf (...) moduleload sssvlv overlay sssvlv sssvlv-max 8 sssvlv-maxkeys 5 #sssvlv-maxperconn 5 <-- this option is not currently availabe in current database backend version (...) # Restart ldap server /etc/init.d/slapd restart # Check ldapsearch -x -b '' -s base '(ObjectClass=*)' + -D "uid=richard,ou=people,dc=example,dc=com" -W (...) supportedControl: 2.16.840.1.113730.3.4.9 <-- LDAP Virtual List View (VLV) supportedControl: 1.2.840.113556.1.4.473 <-- Server Side Control (SSS) (...) Regards, Richard Leger

1 0

Adding and attribute and editing a matchingRuleUse in the subschema
by espeake＠oreillyauto.com 10 Jul '14

10 Jul '14

On our current server running 2.4.31 we have an operational attribute in the schema labeled pwdFailureTime. I have done: slapcat -n 0 -l /tmp/<my_config>.ldif on our production server. I have also used an LDAP browser to export the schema. When I do a a slapadd -F /etc/your/config/goes/here/ -n 0 -l /tmp/<my_config>.ldif I do get the config loaded. I have confirmed that I am loading all of the same modules on both servers and that the config files match. What I don't have is the pwdFailureTime attribute which I need since it is in the data file as well, making it so I cannot import my data either. This is what the attribute looks like in the subschema: attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.19 NAME 'pwdFailureTime' DESC 'The timestamps of the last consecutive authentication failures' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 NO-USER-MODIFICATION USAGE directoryOperation ) Here is the matchingRuleUse: matchingRuleUse: ( 2.5.13.27 NAME 'generalizedTimeMatch' APPLIES ( createTimesta mp $ modifyTimestamp $ pwdChangedTime $ pwdAccountLockedTime $ pwdFailureTime $ pwdGraceUseTime $ birthDate $ hireDate $ statusDate $ openDate ) ) >From other posts that I have read I cannot edit the subschema directly and that makes sense since that would be the fastest way to kill a server. I have tried doing an ldap modify to dn: cn={4}ppolicy,cn=schema,cn=config and I get a syntax error in trying to number the attribute. The new version is 2.4.39 running on ubuntu 12.04 with 3.13 kernel. Thanks Eric Speake Web Systems Administrator O'Reilly Auto Parts (417) 862-2674 Ext. 1975 This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

1 1

SASL not honoring slapo-ppolicy
by Achilleas Mantzios 10 Jul '14

10 Jul '14

Hello list, I have managed successfully to setup a fully functional openldap server on FreeBSD. So far, I had success with : ppolicy, ACLs, legacy SQL exposed as LDAP, SASL authentication. My only problem thus far is combining SASL with ppolicy. When binding with classic simple authentication using -D dn, then ppolicy overlay has the expected effect. However when using SASL (SASL/SCRAM-SHA-1) with -U, while it works correctly converting uid to DN with authz-regexp, it does not seem to look for ppolicy (default or derived from pwdPolicySubentry). Moreover, enforced violations of ppolicy (e.g. failed attempted authentications >= pwdMaxFailure) when done via SASL seem to have no effect on ppolicy attributes, e.g. pwdAccountLockedTime, while they work fine when binding with simple authentication. Is there any way to overcome this? Or is ppolicy honored only via simple DN binds? -- Achilleas Mantzios Head of IT DEV IT DEPT Dynacom Tankers Mgmt

2 3

Re: creating a cn=config modules
by Greg Treantos 09 Jul '14

09 Jul '14

I have read the documentation and cannot figure out how to create a new dit so I can add the module I need. If you can be more specific on what I should be looking for that would be great. But no where have I found that points how to create the cn=module{0} dit so it can be populated. I don't know maybe I'm asking the wrong questions. from the docs 5.2.2. cn=module If support for dynamically loaded modules was enabled when configuring slapd, cn=module entries may be used to specify sets of modules to load. Module entries must have the olcModuleList objectClass. I don't have a cn=module dit, how do I create it? On Wed, Jul 9, 2014 at 6:26 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, July 09, 2014 6:59 PM -0400 Greg Treantos < > gtreanto(a)gmail.com> wrote: > > >> From the man pages ldapadd is just a hardlink to ldapmodify, but I tried >> and got the same error >> >> >> >> ldapadd -Y EXTERNAL -H ldapi:/// -v -f ldapMdynalist.ldif >> ldap_initialize( ldapi:///??base ) >> SASL/EXTERNAL authentication started >> SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth >> SASL SSF: 0 >> add olcModuleLoad: >> {0}/usr/lib64/openldap/memberof.la >> > > The above is invalid. I strongly advise you to read the documentation. > > Also, you should not be touching or creating any files inside the > cn=config database. > > > --Quanah > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Greg http://www.linkedin.com/in/gregtreantos

4 5

Re: creating a cn=config modules
by Greg Treantos 09 Jul '14

09 Jul '14

>From the man pages ldapadd is just a hardlink to ldapmodify, but I tried and got the same error ldapadd -Y EXTERNAL -H ldapi:/// -v -f ldapMdynalist.ldif ldap_initialize( ldapi:///??base ) SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 add olcModuleLoad: {0}/usr/lib64/openldap/memberof.la modifying entry "cn=module{0},cn=config" ldap_modify: No such object (32) matched DN: cn=config I also tried this before and after touching cn=module{0} with ldap:ldap as the owner/group On Wed, Jul 9, 2014 at 5:50 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, July 09, 2014 6:23 PM -0400 Greg Treantos < > gtreanto(a)gmail.com> wrote: > > >> >> Here is what the cn=config directory looks like. As you can see there is >> no olcDatabase={x}module.ldif file so my question is how do you create >> one. >> > > Modify is for objects that exist. Try using ldapadd. > > > --Quanah > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Greg http://www.linkedin.com/in/gregtreantos

2 1

Re: creating a cn=config modules
by Greg Treantos 09 Jul '14

09 Jul '14

Here is what the cn=config directory looks like. As you can see there is no olcDatabase={x}module.ldif file so my question is how do you create one. olcDatabase={2}hdb.ldif olcDatabase={1}monitor.ldif olcDatabase={0}config.ldif cn=schema olcDatabase={-1}frontend.ldif cn=schema.ldif I created this compliant ldif dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: {0}/usr/lib64/openldap/memberof.la but when I try an use ldapmodify -Y EXTERNAL -H ldapi:/// -v -f ldapMdynalist.ldif I get ldap_initialize( ldapi:///??base ) SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 add olcModuleLoad: {0}/usr/lib64/openldap/memberof.la modifying entry "cn=module{0},cn=config" ldap_modify: No such object (32) matched DN: cn=config So how do you create a ldif in cn=config. I've read the docs but it is not clear to me how to do this. Once the file is created I'm sure ldapmodify will work. Do I just touch the file? On Wed, Jul 9, 2014 at 4:54 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, July 09, 2014 2:10 PM -0400 Greg Treantos < > gtreanto(a)gmail.com> wrote: > > 1 dn: cn=module{0},cn=config >> 2 changetype: modify >> 3 add:olcModuleList >> 4 objectClass: olcModuleList >> 5 olcModulePath: /usr/lib64/openldap/ >> 6 cn: module{0} >> 7 changetype: modify >> 8 add: olcModuleLoad >> 9 olcModuleLoad: {0}accesslog.la >> 10 olcModuleLoad: {1}auditlog.la >> 11 olcModuleLoad: {2}constraint.la >> 12 olcModuleLoad: {3}dynlist.la >> 13 olcModuleLoad: {4}memberof.la >> 14 olcModuleLoad: {5}ppolicy.la >> 15 olcModuleLoad: {6}refint.la >> 16 olcModuleLoad: {7}seqmod.la >> 17 olcModuleLoad: {8}syncprov.la >> 18 olcModuleLoad: {9}sssvlv.la >> 19 olcModuleLoad: {10}translucent.la >> 20 olcModuleLoad: {11}unique.la >> 21 olcModuleLoad: {12}back_monitor.la >> > > The above LDIf is clearly invalid. I'm not surprised at all that it gets > rejected. I'd suggest re-reading the documentation on how to use > ldapmodify and the LDIF format. > > --Quanah > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Greg http://www.linkedin.com/in/gregtreantos

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical