openldap-technical

openldap-technical@openldap.org

3 participants
9990 discussions

Problem after migration openldap 2.3.43 to 2.4.23 --> 32 No Such Object
by Jonas Kellens 14 Apr '14

14 Apr '14

Hello, I have a working openLDAP server version 2.3.43. My configuration there works : the correct users have the correct access. I have set up a new openLDAP-server with newer version 2.3.43. I have no working openLDAP on version 2.3.43. I have tried with the new syntax and with the command /usr/sbin/slaptest -f /etc/openldap/slapd.conf -v to use the build in converion tool, but I always got : ldap_bind: Invalid credentials (49) So I forgot this conversion and continued with the "old" slapd.conf file. But in this configuration (which is just a copy/paste of my openLDAP 2.3.43) no user can query the LDAP entries. So this is the setup : I have a user : cn=U101001,ou=101001,dc=mydomain This user is member of the group : cn=tbook1,ou=gebruikers,ou=101001,dc=mydomain These members can read entries in the tree : ou=tbook1,ou=contacten,ou=101001,dc=mydomain I have in slapd.conf : access to dn.one="ou=tbook1,ou=contacten,ou=101001,dc=mydomain" by group.exact="cn=admins,ou=101001,dc=mydomain" write by group.exact="cn=tbook1,ou=gebruikers,ou=101001,dc=mydomain" read This user cn=U101001,ou=101001,dc=mydomain really exists (if you should doubt) : # extended LDIF # # LDAPv3 # base <cn=U101001,ou=101001,dc=mydomain> with scope subtree # filter: (objectclass=*) # requesting: ALL # # U101001, 101001, mydomain dn: cn=U101001,ou=101001,dc=mydomain cn: U101001 sn: U101001 objectClass: inetOrgPerson objectClass: top userPassword:: e1NTSEF9OVBTNmltR3ZpUEhzK1JRQVpickNVdVR5cS9Iejg5TzY= # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 The group cn=tbook1,ou=gebruikers,ou=101001,dc=mydomain also really exists (if you should doubt) : # tbook1, gebruikers, 101001, mydomain dn: cn=tbook1,ou=gebruikers,ou=101001,dc=mydomain cn: tbook1 member: cn=U101001,ou=101001,dc=mydomain objectClass: groupOfNames objectClass: top # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 When I query the LDAP-tree ou=tbook1,ou=contacten,ou=101001,dc=mydomain with my root-account (cn=Manager,dc=mydomain), the I get results : [root@ldap1 ]# ldapsearch -x -D 'cn=Manager,dc=mydomain' -b "ou=tbook1,ou=contacten,ou=101001,dc=mydomain" -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <ou=tbook1,ou=contacten,ou=101001,dc=mydomain> with scope subtree # filter: (objectclass=*) # requesting: ALL # # tbook1, contacten, 101001, mydomain dn: ou=tbook1,ou=contacten,ou=101001,dc=mydomain ou: tbook1 objectClass: organizationalUnit objectClass: top ...<cut>... # search result search: 2 result: 0 Success # numResponses: 5 # numEntries: 4 But when I query this same LDAP-tree with my user cn=U101001,ou=101001,dc=mydomain, I get : [root@ldap1 openldap]# ldapsearch -x -D 'cn=U101001,ou=101001,dc=mydomain' -b "dc=mydomain" -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=mydomain> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 I also have phpLDAPadmin installed and there I see that there are definitely enries in the LDAP-directory ou=tbook1,ou=contacten,ou=101001,dc=mydomain. So why does my user cn=U101001,ou=101001,dc=mydomain fails to get results ?? Kind regards, Jonas.

6 21

LMDB: fast writes: removing the write mutex ?
by Simon Majou 13 Apr '14

13 Apr '14

Hello, I wanted to know, how we could disable the write lock, in case the application shards the writes per thread ? I guess that would imply to have one btree per thread, isn't it ? We could as well use as many DB as threads (at the cost of also sharding the reads) ? In that case, how can I disable the write lock ? Would commenting LOCK_MUTEX_W() & UNLOCK_MUTEX_W() make the trick ? -- Best regards, Simon

1 0

Problems with slapo-rwm
by Fred Snilees 11 Apr '14

11 Apr '14

Hi I am trying to get slapo-rwm module working in a cn=config setup I have openldap with a local DB and ldap database backing onto a MS AD DB I am trying to rewrite objectclass group to groupOfUniqueNames and attribute member to uniqueMember this is what i use to set it up dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: {4}rwm dn: olcOverlay=rwm,olcDatabase={1}ldap,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: rwm olcRwmRewrite: rwm-rewriteEngine "on" olcRwmMap: {1}objectclass group groupOfUniqueNames olcRwmMap: {2}attribute member uniqueMember olcRwmNormalizeMapped: FALSE but when i try a ldapsearch it doesn't work , the object class and attribute are not re written

2 3

Strange password policy behaviour
by Philip Colmer 10 Apr '14

10 Apr '14

I'm using OpenLDAP 2.4.38. At some distant point when I was testing the configuration of our OpenLDAP server, I must have set pwdInHistory to 5 as I have 5 previous passwords stored in my account object. Before going live, though, I changed my mind and set pwdInHistory to 0. However, my account still retains those five previous passwords. I've tried applying a specific pwdPolicy to my object and setting pwdInHistory to 1 then changing my password but the object still retains 5 previous passwords :-(. Given that pwdHistory is read-only and therefore I cannot delete those entries, does anyone have any suggestions on how I can persuade OpenLDAP to forget those old passwords? I don't think changing the password multiple times is going to fix the problem either. Despite setting pwdInHistory to 1, changing the password multiple times doesn't seem to be working in the way I would expect. The five pwdHistory entries that are being shown by Apache Directory Studio all show a date from the beginning of 2013. I would expect ONE of those entries to be replaced with an entry with today's date and, even better, I would expect OpenLDAP to be removing entries if there are more than pwdInHistory's value. Regards Philip

2 2

2.4.39 error when starting openldap with mdb backend
by ping-shin ching 09 Apr '14

09 Apr '14

Using openldap 2.4.39 on solaris 10 sparc box. Bdb runs without any issue. Mdb fails on startup ( described below) Snip from the slapd.conf------------------------------------- database mdbsuffix "o=vtec,c=au"rootdn "cn=manager,o=vtec,c=au"# Cleartext passwords, especially for the rootdn, should# be avoid. See slappasswd(8) and slapd.conf(5) for details.# Use of strong authentication encouraged.rootpw secret# The database directory MUST exist prior to running slapd AND# should only be accessible by the slapd and slap tools.# Mode 700 recommended.directory /data/irene/var/openldap-data-mdbmaxsize 1073741824 Get this error on startup-------------------------------------- 34628c3 1.2.36.79672281.1.13.3 (rdnMatch): 534628c3 2.5.13.1 (distinguishedNameMatch): 534628c3 matchingRuleUse: ( 2.5.13.1 NAME 'distinguishedNameMatch' APPLIES ( creatorsName $ modifiersName $ subschemaSubentry $ entryDN $ namingContexts $ aliasedObjectName $ dynamicSubtrees $ distinguishedName $ seeAlso $ olcDefaultSearchBase $ olcRootDN $ olcSchemaDN $ olcSuffix $ olcUpdateDN $ olcRelay $ member $ owner $ roleOccupant ) )534628c3 2.5.13.0 (objectIdentifierMatch): 534628c3 matchingRuleUse: ( 2.5.13.0 NAME 'objectIdentifierMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ supportedApplicationContext ) )534628c3 slapd startup: initiated.534628c3 backend_startup_one: starting "cn=config"534628c3 config_back_db_openBackend ACL: access to * by * none 534628c3 config_back_db_open: line 0: warning: cannot assess the validity of the ACL scope within backend naming context534628c3 config_back_db_open: No explicit ACL for back-config configured. Using hardcoded default534628c3 config_build_entry: "cn=config"534628c3 config_build_entry: "cn=schema"534628c3 >>> dnNormalize: <cn={0}core>534628c3 <<< dnNormalize: <cn={0}core>534628c3 config_build_entry: "cn={0}core"534628c3 config_build_entry: "olcDatabase={-1}frontend"534628c3 config_build_entry: "olcDatabase={0}config"534628c3 config_build_entry: "olcDatabase={1}mdb"534628c3 backend_startup_one: starting "o=vtec,c=au"534628c3 mdb_db_open: "o=vtec,c=au"534628c3 mdb_db_open: database "o=vtec,c=au": dbenv_open(/data/irene/var/openldap-data-mdb).534628c3 mdb_db_open: database "o=vtec,c=au": mdb_dbi_open(/data/irene/var/openldap-data-mdb/id2e) failed: MDB_BAD_TXN: Transaction cannot recover - it must be aborted (-30782).534628c3 backend_startup_one (type=mdb, suffix="o=vtec,c=au"): bi_db_open failed! (-30782)534628c3 slapd shutdown: initiated534628c3 slapd destroy: freeing system resources.534628c3 slapd stopped.

1 0

syncrepl question
by John Timon 09 Apr '14

09 Apr '14

Hey, I hope that this is a good forum for this question, if not please feel free to tell me where to go ;) I have recently inherited an existing openldap infrastructure. The LDAP tree also stores Kerberos tickets and principals. the environment is configured with a 'master' ldap server and a bunch of 'consumer' nodes all pointing to it for syncrepl. The syncrepl looks like that olcSyncrepl: {0}rid=312 provider="ldaps://<ldap master>:636/" type=refreshAndPersist interval="00:00:01:00" retry="60 30 300 +" searchbase="<base dn>" bi ndmethod=sasl saslmech=gssapi keepalive=3540:10:3 This master server needs to be decommissioned. So I have chosen one of the consumers in the environment to be the new master. And pointed all of the other consumers to use its IP in the provider field. Syncreplication appears to be working as expected. However the new master still has the original in its provider field. Is the process of promoting this new node to 'master' as simple as stopping slapd, removing the olcSyncRepl line from the hdb.ldif file and restarting slapd? Or is this more to it, I am assuming more to it, but I can't seem to verify that suspicion. Thanks -- JT Experience is what you get when you didn't get what you wanted.

1 0

回复： mirror mode question
by Eileen(=^ω^=) 09 Apr '14

09 Apr '14

Hi Michael and Dieter, Thanks for your kindly replies. In my case, I didn't use any SASL or TLS but "simple" method with operation mode of user/password authenticated. However, I need the rootpw hashed (not cleartext) and the 2 servers (master & slave) synchronized. Could you pls advise how i should modify the syncrepl part? or could you pls provide a sample of the slapd.conf file configuration? Best regards, Eileen ------------------ 原始邮件 ------------------ 发件人: "Michael Ströder";<michael(a)stroeder.com>; 发送时间: 2014年3月5日(星期三) 下午4:09 收件人: "Dieter Klünter"<dieter(a)dkluenter.de>; "openldap-technical"<openldap-technical(a)openldap.org>; 主题: Re: mirror mode & sasl question Dieter Klünter wrote: > Am Wed, 5 Mar 2014 14:38:04 +0800 > schrieb "Eileen(=^ω^=)" <123784635(a)qq.com>: >> This is Eileen from China SINAP. I am a beginner for openldap soft. I >> encountered a problem in my study on two LDAP services replication. >> I have 2 LDAP services, one name LDPA1, the other is LDAP2 . I want >> to make them synchronously in mirror mode. But when I set LDAP >> services rootpw both in hash, the 2 LDAP serivces can’t be >> synchronous. My question is >> 1. if I set my rootpw in hash, my bindmethod must be SASL? If I >> must use sasl method, can I put the sasl service in the same ldap >> service? If bindmethod=sasl then what is the saslmech should be? >> 2. If I change to sasl method, do I need change my database >> record? > > In order to use sasl, passwords must be cleartext and you should > configure an apropriate authz-regexp, see man slapd.conf(5) > You may use any sasl mechanism that you sasl framework provides. > [...] To be more precise: In order to use password-based SASL mechs the passwords have to be stored in clear-text. Well, if working with SASL and TLS (LDAPS, StartTLS) one should consider using client certs and SASL/EXTERNAL for replication. Ciao, Michael.

4 7

help with cn=config and rwm
by Alex Samad - Yieldbroker 08 Apr '14

08 Apr '14

Hi Wondering what an example rwm overlay module would look like in cn=config Trying to apply to a msad ldap backend I would like to change group to groupOfUniqueNames and attributr member to uniqueMember Thanks

1 0

dnNormalize with subsequent dnMatch on do_syncrep
by Daniel Jung 07 Apr '14

07 Apr '14

Hi, Running 2.4.37 with mdb backend. Recently I ran one of our test LDAP instance a olcLogLevel with strace and noticed the following in the log: pr 7 00:10:16 servername.com slapd[15271]: connection_get(12) Apr 7 00:10:16 servername.com slapd[15271]: connection_get(12): got connid=0 Apr 7 00:10:16 servername.com slapd[15271]: =>do_syncrepl rid=405 Apr 7 00:10:16 servername.com slapd[15271]: =>do_syncrep2 rid=405 all the entries are being normalized, 75911 Apr 7 00:05:16 servername.com slapd[15271]: >>> dnNormalize: <uid=someone,ou=People,dc=example,dc=com> 75912 Apr 7 00:05:16 servername.com slapd[15271]: <<< dnNormalize: <uid=someone2,ou=people,dc=example,dc=com> 75913 Apr 7 00:05:16 servername.com slapd[15271]: dnMatch 6 75914 Apr 7 00:05:16 servername.com slapd[15271]: dnMatch -6 75915 Apr 7 00:05:16 servername.com slapd[15271]: dnMatch -1 for each of db_syncrep2 action, could this be related to the ITS#7741? Thanks

1 0

unicodePwd
by Jean-Marc Choulet 03 Apr '14

03 Apr '14

Hello, I want to convert my client (ADSI and C++) for use OpenLDAP. I know I must encode the unicodePwd. With ADSI, Miscrosoft give me some functions to do that. How can I do same things from OpenLDAP ? Thanks, Jean-Michel

3 3

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical