openldap-technical

openldap-technical@openldap.org

9 participants
9866 discussions

mirror mode & sasl question
by Eileen(=^ω^=) 05 Mar '14

05 Mar '14

Hi all， This is Eileen from China SINAP. I am a beginner for openldap soft. I encountered a problem in my study on two LDAP services replication. I have 2 LDAP services, one name LDPA1, the other is LDAP2 . I want to make them synchronously in mirror mode. But when I set LDAP services rootpw both in hash, the 2 LDAP serivces can’t be synchronous. My question is 1. if I set my rootpw in hash, my bindmethod must be SASL? If I must use sasl method, can I put the sasl service in the same ldap service? If bindmethod=sasl then what is the saslmech should be? 2. If I change to sasl method, do I need change my database record? My slapd.conf file set as below, could you pls advice which place I should fix? moduleload syncprov.la database bdb suffix "dc=xxx,dc=xxx" checkpoint 1024 15 rootdn "cn=xxx,dc=xxx,dc=xxx" rootpw {SSHA}cXUVsI2kuKNK9kjCagWtvraossyAKuhX directory /var/lib/ldap/xxx access to * by self write by * read # Indices to maintain for this database index objectClass,entryCSN,entryUUID eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub serverID 1 (ldap2 service is 2) syncrepl rid=111 provider=ldap://other side ip bindmethod=sasl saslmech=ssha authcid=? Authzid=? Realm=? binddn="cn=xxx,dc=xxx,dc=xxx" credentials={SSHA}cXUVsI2kuKNK9kjCagWtvraossyAKuhX searchbase="dc=xxx,dc=xxx" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 My database record just like below: dn: cn=tiangexuan,ou=users,dc=xxx,dc=xxx cn: tiangexuan objectClass: posixAccount objectClass: shadowAccount objectClass: inetOrgPerson sn: tiangexuan uid: tiangexuan uidNumber: 10001 gidNumber: 90001 homeDirectory: /home/tiangexuan loginShell: /bin/bash userPassword: calvin Best wishes & regrads Eileen

3 2

Restricting access based on IP Address
by kevin sullivan 05 Mar '14

05 Mar '14

Hi, I am running an OpenLDAP server version 2.4.23 and I would like to restrict a user from connecting unless they are connecting via an ldapi connection or localhost. Specifically, I would like to only let the rootdn manage things from localhost or from an ldapi connection, which ensures that they are on localhost. I do not want to prevent other users from connecting to my LDAP server via an ldaps connection from anywhere on the network. Is this possible? I have read a good bit about access control directives, but I haven't seen what I am looking for. I am guessing that what I am looking for probably deals with 'sockname' or 'sockurl', but I don't know how to use those statements to properly configure slapd. Thanks, Kevin

5 4

Issues with setting up multiple master
by Alex Samad - Yieldbroker 05 Mar '14

05 Mar '14

Hi So I am setting up multi master following the steps here http://www.openldap.org/doc/admin24/replication.html 18.3.3 I have 2 nodes and not 3. I did this on the master dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: secret and on the 2nd dn: cn=config objectClass: olcGlobal cn: config olcServerID: 2 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: secret I used a different password on each site . changed it to the same password no I did this dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 $URI1 olcServerID: 2 $URI2 dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 - add: olcMirrorMode olcMirrorMode: TRUE I am wondering why I did dn: cn=config objectClass: olcGlobal cn: config olcServerID: 2 if I am just going to do this dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 $URI1 olcServerID: 2 $URI2 This is what I get on the second node Mar 5 16:08:09 alcldap1 slapd[21296]: do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD Mar 5 16:08:09 alcldap1 slapd[21296]: do_syncrepl: rid=001 rc -1 retrying (4 retries left) Mar 5 16:08:14 alcldap1 slapd[21296]: do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD Mar 5 16:08:14 alcldap1 slapd[21296]: do_syncrepl: rid=001 rc -1 retrying (4 retries left) Mar 5 16:08:19 alcldap1 slapd[21296]: do_syncrep2: rid=001 got empty syncUUID with LDAP_SYNC_ADD And on the first node Mar 5 16:09:27 gsldap1 slapd[11028]: do_syncrep2: rid=002 got empty syncUUID with LDAP_SYNC_ADD x Mar 5 16:09:27 gsldap1 slapd[11028]: do_syncrepl: rid=002 rc -1 retrying (4 retries left) x I have done manual ldapsearch from both boxes to the other boxes with the credentials and it works So now I am stuff. Had a quick google, but could find anything relevant. Help :) Oh I started with info in the db's already. Just a rsync ... Alex

1 0

ppolicy not working in 2.4.23 !!
by saurabh ohri 05 Mar '14

05 Mar '14

Hi All, tried implementing the ppolicy on 2.4.23 version but it is not working. So i tried installing the upgraded version i.e 2.4.39 from source.but getting following error: Mar 4 12:36:06 juc-dom1-prd slapd[5513]: @(#) $OpenLDAP: slapd 2.4.39 (Mar 4 2014 11:05:59) $#012#011root@juc-dom1-prd.j.cinglevue.com:/tmp/openldap-2.4.39/servers/slapd Mar 4 12:36:06 juc-dom1-prd slapd[5513]: daemon: IPv6 socket() failed errno=97 (Address family not supported by protocol) Mar 4 12:36:06 juc-dom1-prd slapd[5513]: lt_dlopenext failed: (back_bdb.la) file not found Mar 4 12:36:06 juc-dom1-prd slapd[5513]: slapd stopped. Mar 4 12:36:06 juc-dom1-prd slapd[5513]: connections_destroy: nothing to destroy. Previously was getting error: Unrecognized database type (bdb) in openldap 2.4.39 In order to fix this i added below line in slapd.conf file: moduleload back_bdb.la Please help as implementing open ldap is getting crazy now. regards Sam

2 2

Critical GnuTLS bug ...
by Howard Chu 04 Mar '14

04 Mar '14

http://arstechnica.com/security/2014/03/critical-crypto-bug-leaves-linux-hu… Perhaps folks will take us more seriously the next time we say "don't use GnuTLS" ... http://www.openldap.org/lists/openldap-devel/200802/msg00072.html -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 3

Re: LMDB - growing the database
by Nat! 04 Mar '14

04 Mar '14

I wanted to resurrect this thread: >> >> Hi, >> >> I understand that the DB size has an upper limit set by the call to >> mdb_env_set_mapsize . I wonder what is the best strategy for growing the size. >> > The best strategy is to initially pick a large enough size that growing it is never an issue. E.g., set it to the amount of free space on the disk partition where the DB resides. As the docs state, when the DB is actually in use, there's no guarantee that there will be enough free system resources left for a resize attempt to even succeed. I.e., if you initially choose a small size, by the time you need to deal with it it may be too late. > > I have a problem with the "best strategy" because at least on OS X, the reserved file size of "data.mdb" is just the amount set by mdb_env_set_mapsize. Clearly reserving the amount of free space in my user partition would not be desirable, especially if I want to run more than just one lmdb based program. So I tried to grow my db progressively, by setting mdb_env_set_mapsize first to a small value and the enlarging it. Unfortunately it seems, that whenever I increase the env_mapsize, all the committed data is lost and I start with a clean database (determined by mdb_stat). So what gives ? The only thing I have come up with is, that I would need to copy the old database(s) into the new one with a cursor, but that sounds lame. Ciao Nat! --------------------------------------------------- Tradition is an easy alternative to thinking what to do. -- J. Watkinson

3 5

NEW LDAP PROJECT
by Borresen, John - 0442 - MITLL 04 Mar '14

04 Mar '14

All, There is a new project; a group that I support will be using OpenAM to manage single sign-on (SSO). The environment is outward facing, where multiple entities (outside users) will log on to a web portal via openam/opensso. The OpenAM will query the OpenLDAP (currently it is an embedded OpenDJ implementation) for user information. Based on their user credentials they will, hopefully, be forwarded to either a Production, Development or a Demonstration environment. The group wants to migrate to OpenLDAP as OpenDJ is 1) not friendly 2) very slow. I've been looking around at the OpenAM/OpenDJ configuration and most of the schemas are specifically legacy Sun Microsystems & Java specific. Basically, the OpenLDAP will be the User-store for OpenAM. 1) Should I migrate those schemas and everything else currently in OpenDJ over to OpenLDAP and import them? 2) What is the recommended methodology that I should follow to best implement the above scenario? Any pointers are much appreciated. Thanks, John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Email: john.borresen(a)ll.mit.edu

3 2

Troubleshooting OpenLDAP replication
by Igor Zinovik 04 Mar '14

04 Mar '14

Hello, list. I'm experiencing synchronization problem with my ldap provider-consumer setup. Both nodes are running OpenLDAP 2.4.38 (using mdb backend) at x86_64 under Linux 3.7.10. Both servers synchronize their time with one NTP server, so clocks are in sync. I have cn=dhcp,dc=my,dc=org containter which I would like to replicate to openldap consumer. Consumer uses old-fasioned slapd.conf file: # [... include, acl and logging settings skipped ...] rootdn "cn=root,dc=my,dc=org" rootpw [ skipped ] index objectClass eq index entryCSN eq index entryUUID eq index dlzHostname eq index dlzZoneName eq index dlzIPAddr eq index dlzType eq index dhcpHWAddress eq index cn eq,approx,sub syncrepl rid=1 ... syncrepl rid=2 provider=ldap://172.20.20.207 type=refreshAndPersist interval=00:00:01:00 retry="60 +" searchbase="cn=dhcp,dc=my,dc=org" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="uid=dhcpd,ou=services,dc=my,dc=org" credentials="[ skipped ]" Problem is that not all changes (adding new objects and changing attributes of existing objects) are replicated from master to consumer. I make change on master by hand, but I do not see log entries on consumer that changed attribute was replicated. LDAP provider setup (uses online configuartion): dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=my,dc=org olcAddContentAcl: FALSE olcLastMod: TRUE olcLimits: {0}group/groupOfNames/member="cn=ldap admins,ou=groups,dc=my,dc=org" size=unlimited olcLimits: {1}group/groupOfNames/member="cn=ldap admins,ou=groups,dc=my,dc=org" time=unlimited olcLimits: {2}group/groupOfNames/member="cn=admins,ou=mail,ou=groups,dc=my,dc=org" size=unlimited olcLimits: {3}group/groupOfNames/member="cn=replicators,ou=groups,dc=my,dc=org" size=unlimited time=unlimited User uid=dhcpd,ou=services,dc=my,dc=org is member of group cn=replicators,ou=groups,dc=my,dc=org. dn: cn=Replicators,ou=Groups,dc=my,dc=org cn: Replicators member: uid=dhcpd,ou=services,dc=my,dc=org Indices on master server: olcDbIndex: dhcpHWAddress,dhcpClassData eq ACL for cn=dhcp,dc=my,dc=org container (I have only one ACL entry, that mentions cn=dhcp,dc=my,dc=org): ... olcAccess: {15}to dn.subtree="cn=dhcp,dc=my,dc=org" by group/groupOfNames/member.exact="cn=dhcp readers,ou=dhcp,ou=groups,dc=my,dc=org" read by group/groupOfNames/member.exact="cn=dhcp writers,ou=dhcp,ou=groups,dc=my,dc=org" write ... dn: cn=dhcp readers,ou=dhcp,ou=Groups,dc=my,dc=org cn: dhcp readers objectClass: groupOfNames objectClass: top member: uid=dhcpd,ou=Services,dc=my,dc=org So for now I checked following: 1. Clocks on both server (both are in sync) 2. ACL for replication DN (replication user is able to read all needed data). 3. Size and time limits for replication DN (replication user has no limits on operations). 4. Schema (objectClasses and attrubutes) on both servers (both nodes use same schemas). 5. Disable indices on consumer server for replicated attributes from cn=dhcp,dc=my,dc=org container (not helped) What else I can check? BTW, I would be pleased if someone give somekind of systematic approach for troubleshooting OpenLDAP replication issues.

1 0

OpenLDAP: slapi & contrib overlays
by Sergio NNX 03 Mar '14

03 Mar '14

Hi, I'm building OpenLDAP 2.4.39 from source under MinGW. A couple of questions: a) I added '--enable-slapi' to configure. I got a few compilation errors. Is slapi Windows ready? b) I added some contrib modules (e.g. allop, lastbind, etc) and tried to link them statically. Compilation and linking worked OK. Then, I type: slapd -VVV and I expect to see those contrib modules listed under the overlay section. None of them appear. I added 'overlay allop' to slapd.conf, but when slapd starts, I get: 5314932d overlay "allop" not found 5314932d ..\etc\openldap\slapd.conf: line 30: <overlay> handler exited with 1! Can anyone point me to the right direction? Thanks in advance. Ciao, Sergio.

2 2

back-sql mysql and multiple DITs
by Robson, Alan 03 Mar '14

03 Mar '14

Hi, I have tried to set up a single instance of slapd serving information from two DITs that have been defined in separate mysql databases. I can comment out the database entries for either DIT, and everything works for the other DIT. But it won't support the two DITs simultaneously (it seems random which DIT will return results and which returns "no such object" when I restart slapd with both DITs configured). All the odbc stuff for both backends seems fine, isql runs and of course either database can be accessed through ldapsearch if it is the only one slapd serves. I can even run two instances of slapd, one with each DIT and successfully query them separately with ldapsearch, but I'd prefer one instance with the two DITs if possible. Could you please help me get this running, or is it just the law that only one sql backend can be used per server ? Many thanks Alan Slaptest says (when both DITs are defined in one slapd.conf)... WARNING: No dynamic config support for database sql. WARNING: No dynamic config support for database sql. config file testing succeeded slapd.conf (with both backends/DITs) is: # $OpenLDAP$ # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # loglevel 64 moduleload /usr/lib64/openldap/back_sql.la include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/farm.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org #pidfile /usr/local/var/slapd.pid #pidfile /var/run/openldap/slapd.pid #argsfile /usr/local/var/slapd.args ####################################################################### # sql database definitions ####################################################################### database sql suffix "dc=server,dc=farm" rootdn "cn=root,dc=server,dc=farm" rootpw *********** dbname openldap dbuser openldap dbpasswd *************** subtree_cond "ldap_entries.dn LIKE CONCAT('%',?)" insentry_stmt "INSERT INTO ldap_entries (dn,oc_map_id,parent,keyval) VALUES (?,?,?,?)" has_ldapinfo_dn_ru no database sql suffix "dc=lab,dc=farm" rootdn "cn=root,dc=lab,dc=farm" rootpw ********** dbname lab dbuser ldap dbpasswd ******** subtree_cond "ldap_entries.dn LIKE CONCAT('%',?)" insentry_stmt "INSERT INTO ldap_entries (dn,oc_map_id,parent,keyval) VALUES (?,?,?,?)" has_ldapinfo_dn_ru no

2 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical